Calendar providers: generic CalDAV adapter (iCloud, Nextcloud, Fastmail, and more)

## Context

Generic CalDAV is step 3 of the recommended order and M3 in `docs/external-calendars.md`: one adapter unlocks Apple iCloud (app-specific password — Sign in with Apple does not grant calendar access) plus Nextcloud, Fastmail, mailbox.org, Posteo, GMX, Yandex, Zoho, Synology, Radicale, Baikal, SOGo, Stalwart, DAViCal, and Xandikos. It should be built on the KalDAV pure-KMP library (#7) and registered as another `CalendarProvider`/`CalendarSyncAdapter` on the existing connection plumbing. Discovery via `/.well-known/caldav`, PROPFIND/REPORT, and `sync-collection` with ctag fallback cover the server quirks that make this adapter the long-tail solution.

## Tasks

- [ ] `CalDavProvider` implementing `CalendarProvider` + `CalendarSyncAdapter` on top of KalDAV (#7)
- [ ] Connect flow: server URL + username + app-specific password, encrypted via `TokenVault`; iCloud guidance (create the password at `appleid.apple.com`) and CalDAV URL presets
- [ ] Discovery: `/.well-known/caldav`, current-user-principal, calendar-home-set; calendar list via depth-1 PROPFIND
- [ ] Pull sync: `calendar-query`/`calendar-multiget` REPORT, then `sync-collection` with ctag fallback; expired sync tokens trigger a full resync
- [ ] Map href/ETag to `external_id`/`external_etag`; `If-Match` on writes for #4
- [ ] Provider presets/documentation links for the matrix providers; treat href encoding and auth-scheme quirks as first-class tests
- [ ] HTTP auth: Basic/app-password first; leave a seam for Nextcloud OAuth
- [ ] Tests against a fake CalDAV server or recorded fixtures

## References

- `docs/external-calendars.md` — provider matrix, implementation order 3, M3
- `GOALS.md` — CalDAV as a separate pure-KMP library
- `server/src/main/kotlin/dev/kolektiv/kalendee/oauth/CalendarProvider.kt`
- `server/src/main/kotlin/dev/kolektiv/kalendee/oauth/providers/`
- #7 (KalDAV), #8 (server CalDAV endpoints), #4 (two-way writes)

## Dependencies

- Needs #7 (KalDAV M0–M1) for protocol/XML/iCalendar; a thin HTTP-first subset can start earlier.
- Mirrors require #1's pull pipeline; write support requires #4.
- Connection/vault plumbing comes from branch `feat/oauth-foundation` — currently being restored.