fix(security): scope CalDAV PUT to its calendar, block iCal SSRF, auth avatar endpoint

- dav_router: PUT now looks up the event within the authenticated calendar only
  (local_events.uid is globally unique), so a CalDAV client can no longer
  overwrite another user's/calendar's event; a cross-calendar UID clash returns
  409 instead of a 500 from the UNIQUE constraint.
- ical_router: _fetch_ics validates the URL (http/https only), resolves the host
  and rejects private/loopback/link-local/reserved targets, follows redirects
  manually re-validating each hop, and caps the response size — closing an
  authenticated SSRF into internal services / cloud metadata.
- profile_router: GET /profile/avatar/{user_id} now requires authentication.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/profile_router.py

@@ -170,7 +170,11 @@ def get_avatar(current_user: models.User = Depends(get_current_user)):
 
 
 @router.get("/avatar/{user_id}")
-def get_user_avatar(user_id: int, db: Session = Depends(get_db)):
+def get_user_avatar(
+    user_id: int,
+    db: Session = Depends(get_db),
+    current_user: models.User = Depends(get_current_user),
+):
     user = db.query(models.User).filter(models.User.id == user_id).first()
     if not user or not user.avatar_filename:
         raise HTTPException(404, "Kein Profilbild")