Per-campaign ICS feeds from D1 with feed_token

Selective subscription: the one Orrey calendar is the sync spine, and people subscribe to only what they want via Orrey's own per-campaign ICS feeds, generated from D1. Calendar clients can't do OAuth, so the feed URL carries the user's unguessable `feed_token`.

- [ ] `GET /ics/:feedToken/all.ics` and `GET /ics/:feedToken/campaign/:id.ics` served by the Worker from D1; correct `VTIMEZONE`, `UID` per session (reuse the base32hex id), `SEQUENCE` bumped on reschedule.
- [ ] Feed URLs and a **regenerate token** action on the console (regeneration invalidates the old URL).
- [ ] Note in the console that Google refreshes public ICS every ~8–24h — Orrey's calendar is the timely one.

Start with the Worker handlers for GET /ics/:feedToken/all.ics and /ics/:feedToken/campaign/:id.ics, then trace their D1 reads and the console's feed-token regeneration action. Done means both feeds produce the required VTIMEZONE, session UIDs, and reschedule SEQUENCE values; regeneration invalidates the old URL; and the console includes the Google refresh-time note.

Written by the indexing model from the issue text.