caldav leaves the platform

calendar and contacts are a plugin now — plugins/caldav, its own repository like
every other one. a fresh machine runs five processes instead of seven and gets a
calendar by installing one plugin, which is the whole point: the platform stops
carrying a python calendar server for people who may not want one.

what left: the radicale sidecar, four routers, the panel apps, the
dav_app_passwords table, the two screens, the two dock tiles, the permission
registry entry, the settings section, and radicale from every package list.

three platform things had to change first, each committed on its own:
6b5c87da a plugin can be more than one screen; e0df28ff a first-party plugin can
claim a reserved root path. this commit adds the third, `personal` on a plugin
permission — a member granted READ must still mint and revoke their own app
password, because that password is how their own phone reaches their own
calendar. those rows are theirs and nobody else's.

two fixes the work surfaced rather than caused. the dock pinned mountPrefix, so
a multi-screen plugin pinned a tile pointing at /caldav — a route no plugin
serves. and the OPTIONS carve-out was a literal list of four DAV paths; it asks
the claim registry now, so it follows whoever owns the route.

/calendar stays in DEFAULT_DOCK_PATHS. it is installed by default and a fresh
dock that silently dropped it would read as a downgrade.

docs:check earned its keep twice here: it caught spotlight still offering
/settings/integrations/dav-app-passwords after the section was deleted, and the
permission count going 22 -> 21. neither is greppable and both were already wrong
when it ran.

verified against alpha, which is still on the pre-extraction code: /.well-known/
caldav 301s, /dav/ answers 401 with the same WWW-Authenticate realm byte for
byte, /api/caldav/passwords 401s, and OPTIONS reaches the DAV router rather than
being answered as a CORS preflight. installed here end to end — schema applied,
sidecar started, two tiles with their own artwork behind one permission.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

src/servers/hono.ts

@@ -30,12 +30,8 @@ import { agentHandoffRouter } from './api/agent-handoff/router';
 import { terminalRouter } from './api/terminal/sidecar-server';
 import { sendoffRouter } from './api/sendoff/router';
 import { subAgentsRouter } from './api/sub-agents/router';
-import { caldavRouter } from './api/dav/sidecar-server';
 // import { memosRouter } from './api/memos/router';
 import { appStoreRouter } from './api/app-store/router';
-import { davSyncRouter } from './api/dav/sync-router';
-import { davRouter } from './api/dav/router';
-import { claimIosProfile } from './api/dav/ios-profile';
 import { notifyRouter } from './api/notify/router';
 import { systemMonitorRouter } from './api/system-monitor/system-monitor';
 import { activityRouter } from './api/activity/router';
@@ -154,8 +150,6 @@ const PROTECTED_MOUNTS: [prefix: string, router: ReturnType<typeof createRouter>
   // ['/memos', memosRouter],  // plugin — switched off 2026-08-13
   ['/app-store', appStoreRouter],
   ['/plugins', pluginsRouter],
-  ['/caldav', caldavRouter], // the JSON door for Officer's own calendar/contacts UI
-  ['/dav', davRouter], // app-password management (the sync door is /dav, top-level)
   ['/notify', notifyRouter], // core since 2026-08-19 — the one outbound-notification surface
   // ['/photos', photosRouter],  // plugin — switched off 2026-08-13
   ['/system-monitor', systemMonitorRouter],
@@ -257,45 +251,6 @@ export function buildHonoApp(plugins: MountedPlugin[] = []): Hono<{ Variables: H
   // OWNER's token on `/session` and requires the cookie that issues on everything else.
   app.route('/api/dev-proxy', devProxyRouter);
 
-  // CalDAV/CardDAV for phones and desktop clients — mounted TOP-LEVEL for the same reason the vault is:
-  // DAVx5, iOS and Thunderbird authenticate with HTTP Basic on every request and have nowhere to put a
-  // platform JWT, so userMiddleware would 401 them. The credential is a scoped DAV app password; see
-  // api/dav/sync-router.ts.
-  // The iOS profile download, registered BEFORE the /dav mount below because hono matches in registration
-  // order and davSyncRouter's `/*` would otherwise demand HTTP Basic for it. Safari has no credential to
-  // offer — it was handed a URL by the app and nothing else — so the one-shot token in the path IS the
-  // authentication. Minted by POST /api/dav/provision/ios; see api/dav/ios-profile.ts.
-  app.get('/dav/provision/:file', (ctx) => {
-    const file = ctx.req.param('file');
-    const token = file.endsWith('.mobileconfig') ? file.slice(0, -'.mobileconfig'.length) : null;
-    const body = token ? claimIosProfile(token) : null;
-    // Expired, already used, or never existed — all the same 404. There is nothing useful to tell a
-    // caller who has the wrong token, and distinguishing the cases would confirm that a token once existed.
-    if (!body) return ctx.text('not found', 404);
-
-    return new Response(body as unknown as BodyInit, {
-      headers: {
-        // Mandatory. iOS identifies a configuration profile by MIME type; served as octet-stream or
-        // text/xml the file downloads and the OS does nothing with it.
-        'Content-Type': 'application/x-apple-aspen-config',
-        'Cache-Control': 'no-store',
-      },
-    });
-  });
-
-  app.route('/dav', davSyncRouter);
-
-  // Autodiscovery. This is most of what makes adding an account on a phone feel transparent instead of
-  // fiddly: the client is given a bare domain and probes these paths UNAUTHENTICATED before it has any
-  // credential, so they must sit above every auth gate. Without them iOS in particular degrades to
-  // demanding a full collection URL, which is exactly the sort of thing that makes self-hosting feel
-  // worse than the commercial product it is replacing.
-  // `.all`, not `.get`: RFC 6764 §6 has the client probe the well-known URI with the method it actually
-  // wants to use, and iOS sends PROPFIND, not GET. Registered as GET-only these answered 404 to every real
-  // client while looking perfectly healthy in a browser.
-  app.all('/.well-known/caldav', (ctx) => ctx.redirect('/dav/', 301));
-  app.all('/.well-known/carddav', (ctx) => ctx.redirect('/dav/', 301));
-
   const protectedRouter = createRouter();
   protectedRouter.use(bodyParser());
   /*