fix: Google Fit setup on multi-profile — guided wizard, clear errors, per-profile credentials

[joaoferrete]

What changed

• The Google Fit Connect wizard no longer silently reuses the global OAuth client: it shows which client/project is in use and offers to reuse it or supply a per-profile OAuth JSON (profiles/{slug}/fit_credentials.json, takes precedence over the global file).
• OAuth failures now produce actionable messages (access_denied → add the account as a Test user; web-type client → recreate as Desktop app; expired Testing-mode token → auto fall-through to the browser flow), and the flow times out after 5 min instead of hanging forever on Google's 403 page.
• Setup instructions, README and pt_BR/en locales updated (Test users for every connecting account, Desktop-app warning, weekly Testing-mode expiry).

Why

Connecting Google Fit from a second profile was a dead end: the wizard skipped the credentials step because the global fit_credentials.json already existed, the new profile's Google account wasn't a Test user of the project, and Google's "Error 403: access_denied" page never redirects back — so the CLI hung indefinitely with no explanation.

How to test

1. pytest tests/test_fit_setup_wizard.py tests/test_fit_auth_errors.py tests/test_config_paths.py -v — covers all wizard branches, the error classifier, the refresh fall-through and the credentials resolution order (env > profile > global).
2. Manual: with a global fit_credentials.json already configured, create a second profile and run Google Fit → Connect — the client/project panel and the reuse menu must appear (no silent skip), with the Test-user reminder before the browser opens.
3. Manual (failure path): sign in with a Google account that is not a Test user — after the 5-minute timeout the CLI must unblock with a message pointing at Cloud Console → OAuth consent screen → Test users.

Type of change

• Bug fix
• New feature / integration
• Refactor
• Documentation
• Security fix

Checklist

• pytest tests/ -v passes locally (519 passed)
• ruff check . and ruff format --check . pass
• mypy . passes (new-code errors fixed; remaining local noise is missing venv stubs, clean in CI)
• Tests added or updated for any logic touching the DB or analytics
• User-facing strings go through i18n._() with keys in both locales/en.json and locales/pt_BR.json
• No sensitive files committed (.env, *.db, fit_token.json, fit_credentials.json)
• No new dependencies added without justification in the PR description

🤖 Generated with Claude Code