fix: address final review findings for sync-scheduler-web plan

Close the leaked httpx.AsyncClient in MyWhoosh sync runs, ensure hard
failures finish sync_runs as FAILED instead of leaving them stuck at
RUNNING, log (non-benign) exceptions surfaced by sync_all_enabled during
scheduled ticks, classify GarminImportRejected as a non-retryable
per-activity failure, fix a bug where a live Garmin-class action_required
state could be silently cleared by a run that did no Garmin work, use the
activity's DB primary key instead of the unsanitized remote id for
filesystem paths, add regression/coverage tests for the health-state fix
and MFA code threading through the real SyncManager, add idempotency
coverage to the two-user acceptance test, and note the Dockerfile's
single-process assumption.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_acceptance.py

@@ -200,6 +200,24 @@ async def test_two_user_happy_path(session_factory, cipher, settings, two_users)
     tokenstores = {str(call[2]) for call in garmin_factory_calls}
     assert len(tokenstores) == 2
 
+    # Idempotency (spec 26.8): re-running sync_all_enabled with no new remote
+    # activities must not re-download/re-convert/re-import anything, and must
+    # not create a second terminal Activity row for the same MyWhoosh activity.
+    download_calls_a_before = fake_mw_a.download_calls
+    download_calls_b_before = fake_mw_b.download_calls
+    garmin_calls_a_before = fake_garmin_a.calls
+    garmin_calls_b_before = fake_garmin_b.calls
+
+    second_results = await manager.sync_all_enabled()
+
+    assert all(result.status == "success" for result in second_results)
+    assert fake_mw_a.download_calls == download_calls_a_before
+    assert fake_mw_b.download_calls == download_calls_b_before
+    assert fake_garmin_a.calls == garmin_calls_a_before
+    assert fake_garmin_b.calls == garmin_calls_b_before
+    assert count_terminal_activities(session_factory, user_a.id) == 1
+    assert count_terminal_activities(session_factory, user_b.id) == 1
+
 
 @pytest.mark.asyncio
 async def test_isolation_when_one_user_requires_mfa(session_factory, cipher, settings, two_users):