Add logout functionality and Garmin sync structured logging

- Add POST /api/auth/logout endpoint with tests (5 tests)
- Add logout button to settings page (5 tests)
- Add structured logging to garmin-sync cron (sync start/complete/failure)
- Update IMPLEMENTATION_PLAN.md with spec gap analysis findings
- Total: 835 tests passing across 44 test files

Closes spec gaps from authentication.md (logout) and observability.md (logging)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

IMPLEMENTATION_PLAN.md

@@ -4,7 +4,7 @@ This file is maintained by Ralph. Run `./ralph-sandbox.sh plan 3` to generate ta
 
 ## Current State Summary
 
-### Overall Status: 825 tests passing across 43 test files
+### Overall Status: 835 tests passing across 44 test files
 
 ### Library Implementation
 | File | Status | Gap Analysis |
@@ -31,9 +31,10 @@ This file is maintained by Ralph. Run `./ralph-sandbox.sh plan 3` to generate ta
 | OIDC Authentication | specs/authentication.md | P2.18 | **COMPLETE** |
 | Token Expiration Warnings | specs/email.md | P3.9 | **COMPLETE** |
 
-### API Routes (17 total)
+### API Routes (18 total)
 | Route | Status | Notes |
 |-------|--------|-------|
+| POST /api/auth/logout | **COMPLETE** | Clears pb_auth cookie, logs out user (5 tests) |
 | GET /api/user | **COMPLETE** | Returns user profile with `withAuth()` |
 | PATCH /api/user | **COMPLETE** | Updates cycleLength, notificationTime, timezone (17 tests) |
 | POST /api/cycle/period | **COMPLETE** | Logs period start, updates user, creates PeriodLog with prediction tracking (13 tests) |
@@ -109,7 +110,8 @@ This file is maintained by Ralph. Run `./ralph-sandbox.sh plan 3` to generate ta
 | `src/app/api/metrics/route.test.ts` | **EXISTS** - 15 tests (Prometheus format validation, metric types, route handling) |
 | `src/components/calendar/month-view.test.tsx` | **EXISTS** - 30 tests (calendar grid, phase colors, navigation, legend, keyboard navigation) |
 | `src/app/calendar/page.test.tsx` | **EXISTS** - 23 tests (rendering, navigation, ICS subscription, token regeneration) |
-| `src/app/settings/page.test.tsx` | **EXISTS** - 29 tests (form rendering, validation, submission, accessibility) |
+| `src/app/settings/page.test.tsx` | **EXISTS** - 34 tests (form rendering, validation, submission, accessibility, logout functionality) |
+| `src/app/api/auth/logout/route.test.ts` | **EXISTS** - 5 tests (cookie clearing, success response, error handling) |
 | `src/app/settings/garmin/page.test.tsx` | **EXISTS** - 27 tests (connection status, token management) |
 | `src/components/dashboard/decision-card.test.tsx` | **EXISTS** - 11 tests (rendering, status icons, styling) |
 | `src/components/dashboard/data-panel.test.tsx` | **EXISTS** - 18 tests (biometrics display, null handling, styling) |
@@ -640,6 +642,8 @@ Testing, error handling, and refinements.
   - `src/app/api/calendar/[userId]/[token].ics/route.ts` - Replaced console.error with structured logger
   - `src/app/api/overrides/route.ts` - Added "Override toggled" event logging
   - `src/app/api/today/route.ts` - Added "Decision calculated" event logging
+  - `src/app/api/cron/garmin-sync/route.ts` - Added "Garmin sync start", "Garmin sync complete", "Garmin sync failure" logging
+  - `src/app/api/auth/logout/route.ts` - Added "User logged out" logging
 - **Tests:**
   - `src/lib/auth-middleware.test.ts` - Added 3 tests for structured logging (9 total)
 - **Events Logged (per observability spec):**
@@ -647,6 +651,10 @@ Testing, error handling, and refinements.
   - Period logged (info): userId, date
   - Override toggled (info): userId, override, enabled
   - Decision calculated (info): userId, decision, reason
+  - Garmin sync start (info): userId
+  - Garmin sync complete (info): userId, duration_ms, metrics (bodyBattery, hrvStatus)
+  - Garmin sync failure (error): userId, err object
+  - User logged out (info)
   - Error events (error): err object with stack trace
 - **Why:** Better debugging and user experience with structured JSON logs
 
@@ -902,7 +910,8 @@ P4.* UX Polish ────────> After core functionality complete
 - [x] **MonthView** - Calendar grid with DayCell integration, navigation controls (prev/next month, Today button), phase legend, 21 tests
 - [x] **MiniCalendar** - Compact calendar widget with phase colors, navigation, legend, 23 tests (P2.14)
 
-### API Routes (17 complete)
+### API Routes (18 complete)
+- [x] **POST /api/auth/logout** - Clears session cookie, logs user out, 5 tests
 - [x] **GET /api/user** - Returns authenticated user profile, 4 tests (P0.4)
 - [x] **PATCH /api/user** - Updates user profile (cycleLength, notificationTime, timezone), 17 tests (P1.1)
 - [x] **POST /api/cycle/period** - Logs period start date, updates user, creates PeriodLog with prediction tracking, 13 tests (P1.2, P4.5)
@@ -924,7 +933,7 @@ P4.* UX Polish ────────> After core functionality complete
 ### Pages (7 complete)
 - [x] **Login Page** - OIDC (Pocket-ID) with email/password fallback, error handling, loading states, redirect, rate limiting, 32 tests (P1.6, P2.18, P4.6)
 - [x] **Dashboard Page** - Complete daily interface with /api/today integration, DecisionCard, DataPanel, NutritionPanel, OverrideToggles, 23 tests (P1.7)
-- [x] **Settings Page** - Form for cycleLength, notificationTime, timezone with validation, loading states, error handling, 28 tests (P2.9)
+- [x] **Settings Page** - Form for cycleLength, notificationTime, timezone with validation, loading states, error handling, logout button, 34 tests (P2.9)
 - [x] **Settings/Garmin Page** - Token input form, connection status, expiry warnings, disconnect functionality, 27 tests (P2.10)
 - [x] **Calendar Page** - MonthView with navigation controls, ICS subscription section with URL display, copy button, token regeneration, 23 tests (P2.11)
 - [x] **History Page** - Table view of DailyLogs with date filtering, pagination, decision styling, 26 tests (P2.12)
@@ -959,6 +968,21 @@ P4.* UX Polish ────────> After core functionality complete
 
 *Bugs and inconsistencies found during implementation*
 
+### Spec Gaps Discovered (2025-01-11)
+Analysis of all specs vs implementation revealed these gaps:
+
+| Gap | Spec | Status | Notes |
+|-----|------|--------|-------|
+| Logout functionality | authentication.md | **COMPLETE** | Added POST /api/auth/logout + settings button |
+| Garmin sync structured logging | observability.md | **COMPLETE** | Added sync start/complete/failure logging |
+| Email sent/failed logging | observability.md | **PENDING** | Email events should be logged |
+| Period history UI | cycle-tracking.md | **PENDING** | UI for viewing/editing past periods |
+| Dashboard color-coded backgrounds | dashboard.md | **PENDING** | Phase-based background colors |
+| Toast notifications | dashboard.md | **PENDING** | Success/error toasts for user actions |
+| CI pipeline | testing.md | **PENDING** | GitHub Actions for test/lint/build |
+
+### Previously Fixed Issues
+
 - [x] ~~**CRITICAL: Cycle phase boundaries hardcoded for 31-day cycle**~~ - FIXED. Phase boundaries were not scaling with cycle length. The spec (cycle-tracking.md) defines formulas: MENSTRUAL 1-3, FOLLICULAR 4-(cycleLength-16), OVULATION (cycleLength-15)-(cycleLength-14), EARLY_LUTEAL (cycleLength-13)-(cycleLength-7), LATE_LUTEAL (cycleLength-6)-cycleLength. Added `getPhaseBoundaries(cycleLength)` function and updated `getPhase()` to accept cycleLength parameter. Updated all callers (API routes, components) to pass cycleLength. Added 13 new tests.
 - [x] ~~ICS emojis did not match calendar.md spec~~ - FIXED. Changed from colored circles (🔵🟢🟣🟡🔴) to thematic emojis (🩸🌱🌸🌙🌑) per spec.
 - [x] ~~ICS missing CATEGORIES field for calendar app colors~~ - FIXED. Added CATEGORIES field per calendar.md spec: MENSTRUAL=Red, FOLLICULAR=Green, OVULATION=Pink, EARLY_LUTEAL=Yellow, LATE_LUTEAL=Orange. Added 5 new tests.