Server: CalDAV endpoints and app tokens

## Context

Kalendee is a CalDAV server: this issue exposes `/caldav/**` plus `/.well-known/caldav` so third-party clients (Apple Calendar, Thunderbird, DAVx5) can sync. It implements PROPFIND/REPORT/PUT/DELETE/GET with ETags, Basic auth with `caldav_tokens` app tokens, and `sync-collection` backed by a change/tombstone table, all mapping onto `CalendarStore` so there is still a single read path. Protocol/XML work belongs to KalDAV (#7); this issue is the server wiring and persistence.

## Tasks

- [ ] Migration: `caldav_tokens` (per-user app token hash, label, created/last-used, revoked) + a change/tombstone table for `sync-collection` (or a documented equivalent)
- [ ] `/.well-known/caldav` redirect, `OPTIONS`, and `DAV:` response headers
- [ ] PROPFIND: principal, calendar home, calendar collections, `current-user-principal`, `calendar-home-set`, supported-report-set
- [ ] REPORT: `calendar-query`, `calendar-multiget`; `sync-collection` with sync-token + tombstones and 403/valid-sync-token error handling
- [ ] PUT/DELETE/GET with ETag and `If-Match`/`If-None-Match` preconditions, proper 412s, and 201/204 semantics
- [ ] Basic auth: password + app tokens (`caldav_tokens`), disabled-user rejection, throttle failures; never log Authorization headers
- [ ] Map to `CalendarStore`/`PostgresCalendarStore`; provider-mirrored calendars remain read-only (write rejection)
- [ ] `:server` consumes `:kaldav`; keep routes thin and testable
- [ ] Tests: method routing, XML conformance, conditional requests, token auth

## References

- #7 (KalDAV) — protocol engine and codecs
- `server/src/main/kotlin/dev/kolektiv/kalendee/store/PostgresCalendarStore.kt`
- `server/src/main/kotlin/dev/kolektiv/kalendee/api/` — route patterns, `HttpSupport.kt`
- `server/src/main/kotlin/dev/kolektiv/kalendee/plugins/Auth.kt`
- `GOALS.md` — CalDAV server goal; `docs/external-calendars.md` — library/consumer relationship

## Dependencies

- **Depends on #7 (KalDAV M0–M1).**
- Coordinate with #5: the generic CalDAV adapter is the client-side consumer of the same library; shared XML/href handling must not fork.
- App tokens are independent of OAuth; no `feat/oauth-foundation` dependency.