c2c_tracking: activity tracker connections Diagram

① Trackers page: link an account (OAuth), then exchange-token with the c2c JWT
② Tokens exchanged; on link, the last ~30 activities are pulled (Garmin: replay request)
③ Each new activity arrives as a webhook through HAProxy
④ Excluded types and trackless activities are dropped; the 30 newest are kept per user
⑤ A simplified track becomes a Mapbox PNG in SOS
⑥ The outing editor lists activities, each with its matching c2c activity, and their geometry to prefill an outing

Strava, Suunto, Decathlon, Coros: OAuth 2, pull on link, webhook per activity
Garmin: OAuth 1.0a (request secret in Redis, 1 h); no pull, Garmin replays N days through the webhook
Polar: webhook only, signed raw body; no backfill (AccessLink only serves 90 days after linking)
Strava and Polar subscribe their webhook at startup; the subscription is shared in PostgreSQL

No tracking runs on preprod-app; its UI calls tracking.camptocamp.org
Preprod tokens: JWT_SECRET_KEY_EXTRA, user ids shifted by 1,000,000,000
Revocation asked to the preprod API (C2C_API_BASE_URL_EXTRA); no answer means 401
FRONTEND_EXTRA_ORIGINS for CORS; OAuth return goes through the production relay