Provider-agnostic OAuth token store and refresher.
Auth: /auth/whoop
Callback: /auth/whoop/callback
Scopes: read:profile read:body_measurement read:workout read:recovery read:sleep read:cycles offline
Auth: /auth/strava
Callback: /auth/strava/callback
Scopes: read activity:read_all activity:write
Private endpoints require X-Api-Key.