[Bounty $200] security: whoop-app — seven /tools/* routes trust body uid and read the victim's health data

Summary

All seven chat-tool routes in plugins/omi-whoop-app/main.py take uid from the JSON body, call get_valid_access_token(uid) / whoop_api_request(uid, ...), and return that user's Whoop data — no caller authentication:

• get_recovery, get_strain, get_sleep, get_workouts, get_weekly_summary, get_body_measurements, get_profile

This exposes sensitive health data — recovery scores, HRV, strain, sleep, body measurements — for any uid whose Whoop account is connected. Same defect class as the zapier fix (#14428/#14429), the paid mentor fix (#13685), the webhook fixes (#14446/#14447), and twitter-chat-tools (#14451/#14452); whoop was missed by all of them and is not in the #13463 umbrella's file list.

Fix

whoop_tools_auth.py — shared-secret guard (Authorization: Bearer or whoop_tools_token query param, WHOOP_TOOLS_SECRET env, hmac.compare_digest) applied via Depends(require_whoop_tools_auth) to all seven tool routes. Fail-closed 503 when unconfigured, 401 on missing/wrong token. test_weekly_summary.py uses FastAPI's dependency_overrides to bypass the guard (idiomatic; keeps the real-TestClient coverage).

PR with fix + tests follows. cc @kodjima33 @Git-on-my-level