Add GrowthTrack automatic session sync and onboarding

[kwikmn]

What this changes

Connecting the user's own GrowthTrack account through browser PKCE enables automatic sync of each new real finished session. Disconnected and preconnection history stays local; measurements, photos and notes are excluded.

• Keystore-encrypted tokens and pending work, same-grant completion markers, stable session IDs, partial-result handling and persisted network retry jobs.
• Recorded-phase labels for Milking, RIP, Interval pumping and Static pumping, with structured Length precedence; mixed techniques remain one session with per-set detail.
• Optional one-time onboarding with Skip, Settings connection/status, read-only routine previews, and the compact website section with three screenshots approved for public sharing.

GrowthTrack server source is unchanged. No executable routine import or new GrowthTrack routine builder is included.

How it was checked

• :core:test: 2,140 JUnit tests, 0 failures/errors, including 57 integration, 12 automatic-sync and 5 onboarding tests.
• Legacy harness: 35,830 assertions; scenarios: 58 checks; migration cases cover old data and new metadata.
• Unchanged wiring: 1,787 self-tests; 453 pure/46 Android source scan, 0 violations.
• Java 17 syntax parsing, manifest/source checks, website JavaScript and whitespace checks.
• Full Android build, ./gradlew test, :app:assembleDebug and :app:lintDebug — not validated locally.
• Phone/emulator, Keystore/browser/job lifecycle and live OAuth/ingest — not validated.

Developer handoff: docs/growthtrack-developer-handoff.md · Verification: docs/growthtrack-verification.md

Manual testing still required

• Build/lint and load older saved data on supported Android versions.
• Connect/cancel with PKCE and verify malformed callbacks, app locks and secure-window behavior.
• Verify new sessions sync once; disconnected/prior/simulated/unsupported records do not upload.
• Exercise offline, process death/reboot, token rotation, partial responses and disconnect/reconnect isolation.
• Check mixed techniques, Length precedence, interrupted/stitched holds and ambiguous timing exclusions.
• Confirm background sync preserves pump ownership, STOP/vent behavior and UI responsiveness; check mobile website/gallery.

Safety

• No changes to commanded pressure, pump drive timing or STOP/vent gates. New session fields and completion hooks record data; transfer code owns no pump connection.
• Android lifecycle and real-device behavior still require validation before release.

AI assistance

Codex assisted the integration implementation, tests, documentation and website changes. This is a draft for review, with the unvalidated Android/live-integration work listed above.