revert: undo widget service URL change — CAS tickets are not portable

Testing confirmed the embed SSO only issues tickets scoped to sso_embed.
Changing service= to _ios_service_url causes the DI exchange to reject
the ticket with "invalid service ticket provided", and the JWT_WEB
fallback then tries to hit mobile.integration.garmin.com which is not
DNS-resolvable from desktop environments.

The ticket regex improvement (\?ticket= instead of embed\?ticket=)
is kept as it is strictly more flexible.

The root cause of issue #369 ("Token is not active") is server-side:
Garmin's API tier rejecting tokens issued via the sso/embed path.
No client-side fix is possible for the widget strategy.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: cyberjunky

garminconnect/client.py

@@ -456,13 +456,10 @@ def _widget_web_login(self, email: str, password: str) -> None:
             "embedWidget": "true",
             "gauthHost": sso_base,
         }
-        # Use the iOS mobile service URL as the SSO service so the CAS ticket
-        # is issued for mobile.integration.garmin.com.  Since ~2026-06-01
-        # Garmin's API tier rejects DI tokens whose audience is sso/embed.
         signin_params = {
             **embed_params,
             "gauthHost": sso_embed,
-            "service": self._ios_service_url,
+            "service": sso_embed,
             "source": sso_embed,
             "redirectAfterAccountLoginUrl": sso_embed,
             "redirectAfterAccountCreationUrl": sso_embed,
@@ -566,9 +563,7 @@ def _widget_web_login(self, email: str, password: str) -> None:
         if not ticket_match:
             raise GarminConnectConnectionError("Widget login: missing service ticket")
 
-        self._establish_session(
-            ticket_match.group(1), sess=sess, service_url=self._ios_service_url
-        )
+        self._establish_session(ticket_match.group(1), sess=sess, service_url=sso_embed)
 
     def _complete_mfa_widget(self, mfa_code: str) -> None:
         """Complete MFA for widget flow."""
@@ -610,7 +605,7 @@ def _complete_mfa_widget(self, mfa_code: str) -> None:
         self._establish_session(
             ticket_match.group(1),
             sess=sess,
-            service_url=self._ios_service_url,
+            service_url=f"{self._sso}/sso/embed",
         )
 
     # ------------------------------------------------------------------ #