feat(caldav): username/password (Basic Auth) access with discovery + https URLs

- dav_router: add Basic-Auth principal-discovery tree at /caldav/ (and
  /.well-known/caldav) so clients can add a CalDAV account with server URL +
  username + password; lists all published calendars. Token URL /dav/{token}/
  still works without login. Handlers generalised over a base href.
- dav_util: derive the public origin from X-Forwarded-Proto/-Host (or
  PUBLIC_BASE_URL) so published URLs are https, not internal http:8080.
- local_router: expose caldav_login_url alongside caldav_url.
- frontend/i18n: show both the no-login token URL and the login URL + hint.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/js/calendar.js

@@ -3471,6 +3471,12 @@ function renderCalendarTable() {
           <button class="btn btn-ghost btn-sm ct-dav-rotate" data-ct-dav-id="${cal.id}">${t('caldav_token_rotate')}</button>
         </div>
         <div class="ct-dav-hint">${t('caldav_hint')}</div>
+        <div class="ct-dav-box">
+          <span class="ct-dav-label">${t('caldav_login_url')}</span>
+          <input class="ct-dav-url" type="text" readonly value="${escHtml(cal.caldav_login_url || '')}">
+          <button class="btn btn-ghost btn-sm ct-dav-copy">${t('copy')}</button>
+        </div>
+        <div class="ct-dav-hint">${t('caldav_login_hint')}</div>
       </td></tr>`;
     }
   }