[sturimcode]

This release updates Garmin's mobile login strategy and makes a Strava 403 easier to diagnose.

• Raised the garminconnect floor from 0.3.10 to 0.3.20. Version 0.3.20, released on October 23, 2026, restores the library's mobile login, which Garmin had answered with 429 on every attempt since April. It also treats Garmin's new non-standard HTTP 427 as a rate-limit error, which eufy-sync already handles by stopping Garmin for that run and retrying on the next.
• Updated --doctor to distinguish a Strava 401, which means the session is signed out and can be fixed with --setup-strava, from a 403. A 403 most likely means the Strava subscription on the account that owns the API app has lapsed, which signing in again cannot fix; for weight updates, it can also mean the sign-in did not grant permission to edit the profile. The README now clarifies that the subscription keeps an existing app working, not only creates one.
• Corrected the code and test comments about Valid DI token gets 403 on every connectapi call: API session uses plain requests, which Cloudflare rejects (curl_cffi works) cyberjunky/python-garminconnect#444. The reporter later traced the failure to a default entry in ~/.netrc, which made Python's requests replace Garmin's Bearer token and caused Garmin to answer 403. The existing fallback retries any Garmin 403, as well as Cloudflare challenges, once through curl_cffi with a browser fingerprint. Because curl_cffi does not read .netrc, that retry already gets through. The behavior has not changed.
• Updated the version to 1.15.2 in pyproject.toml and eufy_sync/__init__.py.

Tests: 770 pass locally with garminconnect 0.3.20 and curl_cffi 0.17.0 (four new tests cover the Strava 401 and 403 messages and the doctor fix hint); ruff is clean.