Your token doesn't include the required activity:read_all scope. This usually happens when you use the token shown on Strava's API settings page. As noted in
the docs, that one won't work.
To restart authorization
.env with YOUR_REFRESH_TOKEN_OBTAINED_AFTER_AUTH_FLOW