feat: implement ha-garmin 5-strategy cascading login with MFA dual-endpoint fallback

- Add 5-strategy login chain (exact ha-garmin order):
  1. mobile+cffi: iOS app flow (GCM_IOS_DARK) with curl_cffi TLS fingerprint
     rotation (safari_ios → safari → chrome120)
  2. mobile+requests: iOS app flow with plain requests
  3. widget+cffi: SSO embed HTML widget (CSRF form, bypasses clientId limits)
  4. portal+cffi: Desktop browser portal with TLS rotation (5 fingerprints)
  5. portal+requests: Desktop browser portal with plain requests
- Rate-limit tracking: raises GarminConnectTooManyRequestsError only when all
  strategies return 429; otherwise raises GarminConnectConnectionError
- Add anti-WAF delays: portal flow 10-20s, widget flow 3-8s between GET/POST
- Add iOS constants: GCM_IOS_DARK client ID + iPhone UA
- Add widget flow with CSRF extraction and _complete_mfa_widget for MFA
- Unified _complete_mfa routes by _mfa_flow (ios/widget/portal) with
  dual-endpoint fallback for ios/portal MFA verification
- Add GARMIN_CONNECT_MOBILE_IOS_DI to DI client ID rotation
- _portal_service_url is now domain-aware (supports garmin.cn)
- Internal _MFARequired sentinel stops the strategy chain on MFA
- All existing public API and backward compat preserved (19 tests pass)

Author: cyberjunky