Core test coverage for the backend before public launch. Focus on the critical data path — if sync breaks, users lose trust immediately.

Must-have:

• HealthKit sync endpoint (add/update/delete activities)
• Auth flows (sign up, sign in, session validation)
• Activity queries (list, get with nested data)

Nice-to-have:

• Sync state management (anchor tracking, incremental sync)
• Edge cases (duplicate activities, malformed payloads)
• Rate limiting / payload size limits