feat(sharing): group-shared calendars in every member's sidebar, person share picker, hidden profiles

- Backend: co-member group_visible calendars now surface in /local/calendars
  (owned=false, shared_by=owner, read-only, group_shared) and in the normal
  /caldav/events merge (via readable_local_calendar_ids), deduped against
  direct shares / group calendars so nothing appears twice.
- Backend: new User.directory_hidden — a user can hide from sharing/group
  pickers (/users/directory), while admin user management (/users/) still lists
  them. Migration + profile GET/PUT.
- Backend: /groups/{id} members carry shares_calendar so clients can drop
  phantom rows for members who share nothing.
- Frontend: reachable "Teilen" button on owned local calendars; share modal is
  now a checkbox multi-select of users (checked = shared). Hidden-profile toggle
  in Settings → Profile. Group member filter only lists members who actually
  share (phantom fix). Calendars shared with me moved to a dedicated read-only
  "shared with me" section in the manage table.
- Tests: group_visible propagation, no-share absence, dedup, directory_hidden.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/profile_router.py

@@ -34,6 +34,7 @@ class ProfileUpdate(BaseModel):
     email: Optional[str] = Field(default=None, max_length=120)
     display_name: Optional[str] = Field(default=None, max_length=80)
     username: Optional[str] = Field(default=None, max_length=50)  # login name (stored lowercase)
+    directory_hidden: Optional[bool] = None  # hide from sharing/group pickers
 
 
 def _strip_controls(s: str) -> str:
@@ -66,6 +67,7 @@ def get_profile(current_user: models.User = Depends(get_current_user)):
         "is_admin": current_user.is_admin,
         "has_avatar": current_user.avatar_filename is not None,
         "totp_enabled": current_user.totp_enabled,
+        "directory_hidden": bool(current_user.directory_hidden),
     }
 
 
@@ -109,11 +111,15 @@ def update_profile(
             if taken:
                 raise HTTPException(400, "Username already taken")
             current_user.username = new_login
+            if data.directory_hidden is not None:
+                current_user.directory_hidden = data.directory_hidden
             db.commit()
             # The JWT 'sub' is the login name — renaming it invalidates the old
             # token, so hand back a fresh one for the client to store.
             result["access_token"] = create_access_token({"sub": new_login})
             return result
+    if data.directory_hidden is not None:
+        current_user.directory_hidden = data.directory_hidden
     db.commit()
     return result