v0.5.3

Fixed

• Native auth now detects Garmin SSO rate-limit and bot-protection failures instead of collapsing them into UNKNOWN.
• HTTP 429, Cloudflare-like non-JSON responses, and JSON responses without responseStatus.type now return actionable backoff guidance.
• CLI auth output no longer double-prefixes nested failures as "Garmin login failed: Garmin login failed: ...".
• garmin_quickstart now uses the current connection-status shape instead of stale has_credentials/token_present fields.

Changed

• README/docs now use a shorter agent-first front door and full docs/tools.md reference.
• Auth docs explain safe recovery for 429/Cloudflare without asking users to paste secrets.

Verification

• npm test
• npm audit --audit-level=low
• npm pack --dry-run
• GitHub CI and CodeQL passed