feat(caldav): app-specific passwords so MFA accounts can use CalDAV

CalDAV clients send only user+password over Basic Auth and can't provide a TOTP
code, so account passwords would bypass 2FA. Add revocable app passwords:

- models: AppPassword table (bcrypt hash, label, last_used); auto-created via
  create_all
- profile_router: GET/POST/DELETE /profile/app-passwords (plaintext shown once)
- dav_router: Basic Auth accepts any app password; the account password is
  accepted only when 2FA is disabled
- frontend: "App-Passwörter (CalDAV)" section in the profile modal (create/show-
  once/copy/revoke) + i18n (de/en); login hint now says app password

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/css/app.css

@@ -1472,6 +1472,12 @@ a { color: var(--primary); text-decoration: none; }
   background: var(--surface-2); color: var(--text-1);
 }
 .ct-dav-hint { font-size: 11px; color: var(--text-3); margin-top: 6px; max-width: 640px; }
+.app-pw-create { display: flex; gap: 8px; align-items: center; }
+.app-pw-create input { flex: 1; }
+.app-pw-new { margin: 8px 0; }
+.app-pw-item { display: flex; align-items: center; gap: 10px; padding: 6px 0; border-top: 1px solid var(--border); }
+.app-pw-name { font-weight: 500; }
+.app-pw-meta { font-size: 11px; color: var(--text-3); margin-left: auto; }
 .ct-eye, .ct-bell { opacity: .45; transition: opacity .15s; }
 .ct-eye[data-ct-visible="1"], .ct-bell[data-ct-on="1"] { opacity: 1; }
 .ct-eye:hover, .ct-bell:hover { opacity: 1; }