Fix Invalid Date error in auth middleware

Add parseDate helper that safely returns null for empty/invalid date
strings from PocketBase. This prevents RangeError when pino logger
tries to serialize Invalid Date objects via toISOString().

- Make garminTokenExpiresAt and lastPeriodDate nullable in User type
- Filter garmin-sync cron to skip users without required dates
- Add test assertions for null date handling

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/app/api/calendar/[userId]/[token].ics/route.test.ts

@@ -27,7 +27,8 @@ vi.mock("@/lib/pocketbase", () => ({
               id: user.id,
               email: user.email,
               calendarToken: user.calendarToken,
-              lastPeriodDate: user.lastPeriodDate.toISOString(),
+              // biome-ignore lint/style/noNonNullAssertion: mock user has valid date
+              lastPeriodDate: user.lastPeriodDate!.toISOString(),
               cycleLength: user.cycleLength,
               garminConnected: user.garminConnected,
             };

src/app/api/cron/garmin-sync/route.ts

@@ -54,8 +54,11 @@ export async function POST(request: Request) {
   const pb = createPocketBaseClient();
 
   // Fetch all users (we'll filter garminConnected in code to avoid PocketBase query syntax issues)
+  // Also filter out users without required date fields (garminTokenExpiresAt, lastPeriodDate)
   const allUsers = await pb.collection("users").getFullList<User>();
-  const users = allUsers.filter((u) => u.garminConnected);
+  const users = allUsers.filter(
+    (u) => u.garminConnected && u.garminTokenExpiresAt && u.lastPeriodDate,
+  );
 
   const today = new Date().toISOString().split("T")[0];
 
@@ -64,10 +67,12 @@ export async function POST(request: Request) {
 
     try {
       // Check if tokens are expired
+      // Note: garminTokenExpiresAt and lastPeriodDate are guaranteed non-null by filter above
       const tokens: GarminTokens = {
         oauth1: user.garminOauth1Token,
         oauth2: user.garminOauth2Token,
-        expires_at: user.garminTokenExpiresAt.toISOString(),
+        // biome-ignore lint/style/noNonNullAssertion: filtered above
+        expires_at: user.garminTokenExpiresAt!.toISOString(),
       };
 
       if (isTokenExpired(tokens)) {
@@ -101,9 +106,10 @@ export async function POST(request: Request) {
         fetchIntensityMinutes(accessToken),
       ]);
 
-      // Calculate cycle info
+      // Calculate cycle info (lastPeriodDate guaranteed non-null by filter above)
       const cycleDay = getCycleDay(
-        user.lastPeriodDate,
+        // biome-ignore lint/style/noNonNullAssertion: filtered above
+        user.lastPeriodDate!,
         user.cycleLength,
         new Date(),
       );