feat(openclaw,infra): optimize token usage with GLM-5.3-Flash and add Garmin MCP integration

- Migrate OpenClaw primary model to z-ai/glm-5.3-flash across conductor, heartbeat, subagents, and vision
- Configure deepseek-v4.1-flash and qwen3.8-flash as fallback models; retire claude-3.7-sonnet and deepseek-v4-pro
- Decouple heartbeat target to prevent active session context amplification and token bleed
- Add Garmin Connect MCP integration, secret unpacking, and Elite Strength Coach SOUL protocol
- Add ADR 0001 documenting hybrid tool search and subagent architecture
- Update Authentik configuration, theme styles, and Terraform state
- Add Grafana dashboard for Taupi fan monitoring and update Velero secrets
- Bump knowledge-wiki submodule pointer

terraform/authentik.tf

@@ -130,7 +130,28 @@ resource "authentik_stage_user_write" "haumdaucher_enrollment_write" {
 # 5. User Login Stage (starts the user session)
 resource "authentik_stage_user_login" "haumdaucher_enrollment_login" {
   name             = "haumdaucher-enrollment-login"
-  session_duration = "seconds=0"
+  session_duration = "days=30"
+}
+
+# Master Flow: Default User Login Stage (30-day persistent browser session)
+import {
+  to = authentik_stage_user_login.default_authentication_login
+  id = "49749dd0-3c0d-41e2-9f10-e6c66d719901"
+}
+
+resource "authentik_stage_user_login" "default_authentication_login" {
+  name             = "default-authentication-login"
+  session_duration = "days=30"
+}
+
+import {
+  to = authentik_stage_user_login.default_source_authentication_login
+  id = "7ff5a23d-6f78-4539-b40f-d7fb24af0ae7"
+}
+
+resource "authentik_stage_user_login" "default_source_authentication_login" {
+  name             = "default-source-authentication-login"
+  session_duration = "days=30"
 }
 
 # 6. Redirect Stage (redirects user to haumdaucher.de after successful registration)