Make exporting a calendar work, and CalDAV publishing findable

Exporting any calendar whose name is not pure ASCII failed. str.isalnum() is
true for "ö", so the "safe" filename kept the umlaut and went into
Content-Disposition raw — an HTTP header must be ASCII, and a reverse proxy
drops the response. The client then had no JSON to read and showed its
"unknown error" fallback, which said nothing at all. attachments_router had
already learned this and documents it in a comment; the export endpoint never
got the same treatment. Now RFC 6266, exactly as that router does it.

downloadRequest discarded a non-JSON error body entirely. That body is the only
clue when the failure happens outside the app, so it is used now, with the
status appended when there is nothing to read.

The CalDAV publish button rendered as "..." — four buttons never fitted the
240px actions column, and the cell clips instead of overflowing because the
columns are drag-resizable. Nobody could tell there was a button there, which
is why publishing a calendar to Home Assistant looked impossible: the URL, the
copy button and both hints only appear once it is switched on. The label is now
just "CalDAV" with the full action as its tooltip, which also helps anyone who
already dragged that column narrower, since saved widths beat the default.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/routers/local_router.py

@@ -15,6 +15,7 @@ import permissions
 from auth import get_current_user
 from database import get_db
 from local_events_util import build_local_event_dict, resolve_creator
+from urllib.parse import quote
 
 router = APIRouter()
 
@@ -839,9 +840,20 @@ def export_calendar(
         atts = attachments_store.by_event(db, [e.id for e in events])
     ics = ical_io.build_ics(cal, events, name_cache=name_cache,
                             attachments_by_event=atts, base_url=base_url)
-    safe_name = "".join(c for c in cal.name if c.isalnum() or c in (" ", "-", "_")).strip() or "calendar"
+    # RFC 6266, the same way attachments_router already does it: str.isalnum()
+    # is true for "ö", so without an explicit ASCII test the "safe" name carries
+    # the very bytes it exists to avoid — a raw umlaut in an HTTP header, which
+    # a reverse proxy rejects outright. That is what made exporting a calendar
+    # called "Persönlich" fail with no usable error.
+    ascii_name = "".join(
+        c for c in cal.name if c.isascii() and (c.isalnum() or c in " -_")
+    ).strip() or "calendar"
+    disposition = (
+        f'attachment; filename="{ascii_name}.ics"; '
+        f"filename*=UTF-8''{quote(cal.name + '.ics')}"
+    )
     return Response(
         content=ics,
         media_type="text/calendar",
-        headers={"Content-Disposition": f'attachment; filename="{safe_name}.ics"'},
+        headers={"Content-Disposition": disposition},
     )