OAUTH-001A2B: redact Strava activity-load browser failures

[daliu]

Outcome

My Account now treats a rejected Strava stats value as opaque and shows one fixed retry-later alert. It no longer reads or renders the rejection's message, and successful activity display remains unchanged.

Closes #250. Canonical parent #88 remains open.

Privacy and behavior invariant

• The connection resolves before exactly one stats request.
• A rejection is not read, retained, coerced, stringified, or logged.
• Failure ends loading and shows only: We could not load your Strava activity right now. Please try again later.
• The sentence is an atomic assertive alert; the connected athlete remains visible.
• A successful synthetic result still renders recent activity and totals.

Proof

• Intended old-source red: focused suite was 28 pass / 1 intended failure. The old page rendered provider-private-canary member@example.test and had no fixed alert.
• Focused Account suite: 31/31 PASS, including deferred connection ordering, ordinary canary redaction, hostile throwing message getter non-inspection, five-console silence, loading completion, connected identity, and successful projection.
• Full frontend: 12 suites / 254 tests PASS.
• Frontend lint: unchanged deterministic baseline, 106 files / 123 reviewed errors / 7 warnings.
• TypeScript no-emit check, SPA 11/11, workflow/release/artifact 42/42, production diagnostic build, and git diff --check: PASS.
• Independent final reviews: privacy/security PASS; adversarial frontend/accessibility PASS after its deferred-ordering finding was fixed; scope/officer/deployment truth PASS.
• Final pre-commit diff SHA-256: e773c132171e09b6318d5d94135befcf080e3610fa9d22b254876d9fd0d702c7.

All Firebase and Strava behavior in tests is mocked. No provider or production network path ran.

Residual risk and migration

Migration impact: none. No stored data, schema, permission, or provider behavior changes.

Explicitly excluded and still unsafe: the existing browser disconnect catch can render a raw rejection message. It remains a separately claimable OAUTH-001B browser child. Connection-load recovery, server/provider response validation, callback/state/code/App Check, tokens/scopes/account binding, refresh concurrency, revoke/audit, IAM/encryption, provider setup, deployment, and live verification remain under #88.

Officer handoff

Officer impact: members receive one plain retry-later sentence instead of technical/provider detail. Keep it marked source-only until the exact website revision is published and verified.

Officer documentation: docs/officers/EVENTS_SHOP_MEMBERS.md — added the separately named Strava activity failure privacy — SOURCE ONLY, NOT LIVE recognition/evidence section.

Deployment evidence: Source changed and local tests passed. Website publication: not performed. runmprc.com: not verified because no website publication occurred. Firebase deployment: not performed. Strava/provider configuration: not changed or verified. Production data/migration: none. Live behavior: not claimed.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	99c2381
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a55e88088969800089545e7
😎 Deploy Preview	https://deploy-preview-251--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.