Add search, calendar, music queue/resume, file actions, More menu

- Calendar agenda from private ICS feeds (recurrence, EXDATE, overrides, time zones, SSRF guard)
- Search across libraries, files (recursive fallback) and Plex
- Home dashboard: now playing, today's agenda, recent files
- Files: rename, move, share link, preview, create new documents
- Music: recently added, play next / add to queue, queue sheet, resume on launch
- Phone tab bar shows four tabs plus a More menu

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -23,7 +23,11 @@ e.g. hub.necloud.us. Settings: `SEAFILE_URL`, `ONLYOFFICE_URL` env vars in docke
   The server proxies `/sf/*` to Seafile because Seafile sends no CORS headers. Token lives in the browser only.
   Office files open in Seafile's own OnlyOffice integration.
 - **Edit here**: opens docs inside the app via OnlyOffice. The server signs each editor config with the JWT secret and saves edits back to Seafile.
-- **Music**: Plex player. Sign in goes through plex.tv (no password handled), the server proxies your Plex server and adds the token itself, and a mini player keeps playing as you move between tabs.
+- **Sign-in**: the whole app sits behind a passkey (WebAuthn). First run: open the site and enter the setup code (`HUB_SETUP_CODE`, or the one printed in the server log) to create a passkey; add more devices from Settings. Passkeys and the session secret live in `/data` (a Docker volume).
+- **Files**: also rename, move, share links, image/PDF/video/audio preview, and New document/spreadsheet/presentation.
+- **Calendar**: agenda from private ICS links (Google secret address, Outlook/M365 published link, iCloud public calendar). Links are stored on the server in `/data`.
+- **Search**: libraries, file names (scans libraries if Seafile has no search index) and Plex artists/albums/tracks.
+- **Music**: Plex player. Sign in goes through plex.tv (no password handled), the server proxies your Plex server and adds the token itself, and a mini player keeps playing as you move between tabs; the queue (play next / add to queue) and position are remembered.
 - **Audio**: embeds audiobooks.necloud.us; sign-in details saved in Settings can be copied with one tap.
 - **Office**: embeds onlyoffice.necloud.us in a frame, with an "open in new tab" fallback if it blocks framing.
 - **Mail**: deep links to Gmail, Outlook.com, Microsoft 365 and iCloud webmail (inbox + compose).