fix(demo): servico-saude 1.77-garmin (Garmin OAuth diagnostico de rede) + JAVA_TOOL_OPTIONS IPv4

- imagem 1.77-garmin: separa falha de rede (garmin_api_unreachable) do
  token_exchange_failed generico e loga a causa raiz no callback OAuth.
- JAVA_TOOL_OPTIONS=-Djava.net.preferIPv4Stack=true persistido no GitOps
  (antes so no deployment vivo; ArgoCD sync/prune poderia remover).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tenants/demo/78-servico-saude.yaml

@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: servico-saude
-          image: docker.io/library/servico-saude:1.76-garmin
+          image: docker.io/library/servico-saude:1.77-garmin
           imagePullPolicy: Never
           ports: [{ containerPort: 8083 }]
           env:
@@ -33,6 +33,8 @@ spec:
             - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
             - { name: ATM_ISSUER, value: "https://auth-demo.athleticmap.influxdigital.com.br/realms/athleticmap" }
             - { name: ATM_TENANT, value: "demo" }
+            # Garmin: DNS devolve IPv6 primeiro e a rota IPv6 do cluster falha; forcar IPv4.
+            - { name: JAVA_TOOL_OPTIONS, value: "-Djava.net.preferIPv4Stack=true" }
             - { name: GARMIN_REDIRECT_URI, value: "https://demo.athleticmap.influxdigital.com.br/api/public/integrations/garmin/callback" }
             - { name: GARMIN_FRONTEND_REDIRECT, value: "https://demo.athleticmap.influxdigital.com.br/integracoes/garmin" }
             - name: GARMIN_CLIENT_ID