Calendar: add events (NE Hub calendar + iCloud) and a Podcast tab

- Add, edit and delete events; month/agenda views open them on tap
- NE Hub calendar stored on the server and published as a private ICS subscribe link
- iCloud CalDAV read/write with an app-specific password (encrypted at rest,
  only *.icloud.com contacted, event addresses checked against the calendar)
- Edits patch the existing entry so alarms/attendees survive; writes use If-Match / If-None-Match
- Time zone definitions (VTIMEZONE) generated so other apps read times correctly
- Podcast tab (PODCAST_URL) alongside Podcast Admin

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

server.js

@@ -12,6 +12,7 @@ const AUDIOBOOKS_URL = (process.env.AUDIOBOOKS_URL || 'https://audiobooks.neclou
 const auth = require('./auth');
 const cal = require('./cal');
 const VERSE_URL = process.env.VERSE_URL || 'https://versebyversewithnate.us/admin';
+const PODCAST_URL = process.env.PODCAST_URL || 'http://172.16.16.106:8383/';
 const PUBLIC = path.join(__dirname, 'public');
 
 const TYPES = {
@@ -274,6 +275,7 @@ if (!JWT_SECRET) console.warn('WARNING: ONLYOFFICE_JWT_SECRET not set. In-app ed
 http.createServer((req, res) => {
   const pathname = new URL(req.url, 'http://x').pathname;
   if (pathname.startsWith('/api/auth/')) return auth.handle(req, res);
+  if (pathname.startsWith('/cal/feed/')) return cal.feed(req, res); // subscribe feed: protected by its own secret token, not the session
   // Everything else needs a passkey session, except the sign-in page and its assets,
   // and OnlyOffice's save callback (which carries its own signed token).
   const open = ['/login', '/login.js', '/webauthn.js', '/style.css', '/icon.svg', '/manifest.webmanifest', '/sw.js', '/api/oo/callback'];
@@ -283,7 +285,7 @@ http.createServer((req, res) => {
   }
   if (req.url === '/api/config') {
     res.writeHead(200, { 'content-type': 'application/json' });
-    return res.end(JSON.stringify({ seafile: SEAFILE_URL, onlyoffice: ONLYOFFICE_URL, audiobooks: AUDIOBOOKS_URL, verse: VERSE_URL, editor: true, jwt: !!JWT_SECRET }));
+    return res.end(JSON.stringify({ seafile: SEAFILE_URL, onlyoffice: ONLYOFFICE_URL, audiobooks: AUDIOBOOKS_URL, verse: VERSE_URL, podcast: PODCAST_URL, editor: true, jwt: !!JWT_SECRET }));
   }
   if (req.method === 'POST' && req.url === '/api/oo/config') return ooConfig(req, res);
   if (req.method === 'POST' && req.url.startsWith('/api/oo/callback')) return ooCallback(req, res);