Per-campaign ICS feeds from D1 with feed_token

Selective subscription: the one Orrey calendar is the sync spine, and people subscribe to only what they want via Orrey's own per-campaign ICS feeds, generated from D1. Calendar clients can't do OAuth, so the feed URL carries the user's unguessable `feed_token`.

- [ ] `GET /ics/:feedToken/all.ics` and `GET /ics/:feedToken/campaign/:id.ics` served by the Worker from D1; correct `VTIMEZONE`, `UID` per session (reuse the base32hex id), `SEQUENCE` bumped on reschedule.
- [ ] Feed URLs and a **regenerate token** action on the console (regeneration invalidates the old URL).
- [ ] Note in the console that Google refreshes public ICS every ~8–24h — Orrey's calendar is the timely one.