Fix Cloudflare SSO blocking with Safari TLS impersonation and multi-strategy login

Cloudflare blocks programmatic SSO login based on TLS fingerprinting.
Safari impersonation via curl_cffi bypasses this where Chrome gets 429'd.

- Add portal web login (/portal/api/login) as primary strategy with
  desktop browser headers — Garmin's own website uses this endpoint
- Try multiple curl_cffi TLS impersonations: safari, safari_ios,
  chrome120, edge101, chrome (safari works best)
- Fall through 429/connection errors to next strategy instead of failing
- Add random browser UA generation via ua-generator to avoid fingerprinting
- Use curl_cffi for DI token exchange and refresh (not just login)
- Try both portal and mobile MFA endpoints with detailed error reporting
- Proactively refresh DI tokens on load if expiring soon
- Add ua-generator dependency to pyproject.toml

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: cyberjunky

garminconnect/__init__.py

@@ -437,6 +437,17 @@ def login(self, /, tokenstore: str | None = None) -> tuple[str | None, str | Non
                         )
                         self.client.load(normalized_path)
                     tokens_loaded = True
+
+                    # Proactively refresh DI token if it's expired or about to expire.
+                    # This avoids hitting the SSO login endpoint (which may be
+                    # Cloudflare-blocked) when a simple DI refresh would suffice.
+                    if (
+                        self.client.di_refresh_token
+                        and self.client._token_expires_soon()
+                    ):
+                        logger.debug("Token expiring soon, refreshing proactively")
+                        self.client._refresh_session()
+
                 except Exception as e:
                     logger.debug(
                         f"Failed to cleanly load tokens from {tokenstore}: {e}"