feat(sharing): group-shared calendars in every member's sidebar, person share picker, hidden profiles

- Backend: co-member group_visible calendars now surface in /local/calendars
  (owned=false, shared_by=owner, read-only, group_shared) and in the normal
  /caldav/events merge (via readable_local_calendar_ids), deduped against
  direct shares / group calendars so nothing appears twice.
- Backend: new User.directory_hidden — a user can hide from sharing/group
  pickers (/users/directory), while admin user management (/users/) still lists
  them. Migration + profile GET/PUT.
- Backend: /groups/{id} members carry shares_calendar so clients can drop
  phantom rows for members who share nothing.
- Frontend: reachable "Teilen" button on owned local calendars; share modal is
  now a checkbox multi-select of users (checked = shared). Hidden-profile toggle
  in Settings → Profile. Group member filter only lists members who actually
  share (phantom fix). Calendars shared with me moved to a dedicated read-only
  "shared with me" section in the manage table.
- Tests: group_visible propagation, no-share absence, dedup, directory_hidden.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/local_router.py

@@ -167,6 +167,23 @@ def list_calendars(
         d = _cal_dict(cal, owned=False, shared_by=group_name, permission="read_write")
         d["group"] = True
         result.append(d)
+
+    # Calendars co-members share into shared groups (group_visible_calendar_id).
+    # Read-only, shown under the owner's name. Deduped against everything above
+    # so a calendar already shared directly / as a group calendar isn't doubled.
+    for cal in permissions.co_member_group_visible_calendars(db, current_user):
+        if cal.id in seen_ids:
+            continue
+        seen_ids.add(cal.id)
+        owner = db.query(models.User).filter(models.User.id == cal.user_id).first()
+        d = _cal_dict(
+            cal, owned=False,
+            shared_by=(owner.display_name or owner.username) if owner else None,
+            permission="read",
+            request=request,
+        )
+        d["group_shared"] = True
+        result.append(d)
     return result