M4 Calendar: publish public .ics links, subscriptions, multi-calendar settings

Calendar (builtin plugin):
- Publish read-only public .ics feed per calendar via vault-sealed token
  (full-detail or free/busy-only); unauthenticated GET /public/{token},
  404 on bad/absent token. Migration calendar0004 adds publish_token,
  publish_busy, subscription_url + partial unique index.
- Subscribe to external iCal (.ics) URLs (SSRF-guarded) as read-only
  calendars; CSRF-guarded POST /subscriptions.
- Settings > Calendars: create/edit/delete, publish toggles with live
  shareable link + copy, Add-account stubs (Google/iCloud/CalDAV, deferred),
  Subscriptions section; default calendar + default reminders; auto-detected
  time zone; color-dropdown contrast fix; 3x-larger edit arrow.
- Left panel: shared Mail-parity sidebar template (.wm-side-*), calendar
  search panel, font/spacing tuning, per-section "+" create shortcut.

Frontend: CalendarOut publish fields, api publish/subscribe, settings keys.
Backend: settings default_calendar + reminder lists.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA

dev-environment-setup.md

@@ -157,8 +157,8 @@ cd backend && alembic upgrade head && cd ..  # migrations against 5433
 # Terminal 1 — API
 uvicorn app.main:create_app --factory --reload --port 8000 --app-dir backend
 
-# Terminal 2 — worker
-arq workers.worker.WorkerSettings            # from backend/
+# Terminal 2 — worker (sync supervisor + arq job consumers in one process)
+cd backend && WORKER_ROLE=all python -m workers.run
 
 # Terminal 3 — frontend
 cd frontend && npm run dev                   # Vite on 5173, proxies /api -> 8000
@@ -194,8 +194,12 @@ reset-db:  ## DESTRUCTIVE: wipe db + search + blobs, re-migrate
 	cd backend && alembic upgrade head
 api:
 	uvicorn app.main:create_app --factory --reload --port 8000 --app-dir backend
-worker:
-	cd backend && arq workers.worker.WorkerSettings
+worker:      ## run both sync + jobs in one process (dev)
+	cd backend && WORKER_ROLE=all python -m workers.run
+worker-sync: ## run only the account-sync supervisor
+	cd backend && WORKER_ROLE=sync python -m workers.run
+worker-jobs: ## run only the arq job consumers (interactive + bulk)
+	cd backend && WORKER_ROLE=jobs python -m workers.run
 web:
 	cd frontend && npm run dev
 test: