feat(caldav): username/password (Basic Auth) access with discovery + https URLs

- dav_router: add Basic-Auth principal-discovery tree at /caldav/ (and
  /.well-known/caldav) so clients can add a CalDAV account with server URL +
  username + password; lists all published calendars. Token URL /dav/{token}/
  still works without login. Handlers generalised over a base href.
- dav_util: derive the public origin from X-Forwarded-Proto/-Host (or
  PUBLIC_BASE_URL) so published URLs are https, not internal http:8080.
- local_router: expose caldav_login_url alongside caldav_url.
- frontend/i18n: show both the no-login token URL and the login URL + hint.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/local_router.py

@@ -81,9 +81,10 @@ def _cal_dict(cal: models.LocalCalendar, *, owned: bool = True,
         "type": "local",
         "owned": owned,
     }
-    # Only the owner may publish; expose the subscribe URL only when active.
+    # Only the owner may publish; expose the subscribe URLs only when active.
     if owned and cal.caldav_published and cal.dav_token:
         d["caldav_url"] = dav_util.caldav_url(request, cal.dav_token) if request else None
+        d["caldav_login_url"] = dav_util.caldav_login_url(request) if request else None
     if shared_by is not None:
         d["shared_by"] = shared_by
     if permission is not None: