feat: build Stride local app with Garmin imports and friends-only sharing

docs/SYNC_VALIDATION.md

@@ -0,0 +1,30 @@
+# Local sync validation
+
+Date: 2026-09-30
+
+## Implemented and verified offline
+
+- Python 3.12.12 virtual environment created locally with uv.
+- Garmin client pinned to 0.3.17; complete dependency resolution in uv.lock.
+- Interactive login/MFA, token import, password-free session verification, and sync CLI.
+- Bounded recent activity pagination; all activities or running filter.
+- Original download preservation, CRC-checked FIT decoding, sessions/laps/records JSON.
+- Account-partitioned storage, profile locks, atomic files, checksums and repeat-run skipping.
+- Errors suppress raw provider responses and credential-bearing exception text.
+- Automated tests cover synthetic FIT decoding/CRC, archives, pagination, retries,
+  account separation, credential persistence, and secret redaction.
+
+## Live account checks
+
+- [x] Owner completes local login and MFA where required.
+- [x] Saved session verifies in a new process without a password.
+- [x] At least one completed activity is downloaded from Garmin.
+- [x] FIT decoding reports recorded samples (or explains a valid activity without samples).
+- [ ] Repeating the same sync skips completed activities.
+- [ ] Exported session is validated on a separate Linux/Dokku runtime.
+- [ ] A real refresh/reconnect lifecycle is observed.
+
+User-confirmed live result: 5 found, 5 downloaded, 0 failed, 10,599 recorded
+samples. Login and sync ran as separate CLI processes. Local Flask importer also
+successfully read these files into a temporary database, with repeat imports
+producing no duplicates. Linux/Dokku portability and live refresh remain unverified.