caldav leaves the platform

calendar and contacts are a plugin now — plugins/caldav, its own repository like
every other one. a fresh machine runs five processes instead of seven and gets a
calendar by installing one plugin, which is the whole point: the platform stops
carrying a python calendar server for people who may not want one.

what left: the radicale sidecar, four routers, the panel apps, the
dav_app_passwords table, the two screens, the two dock tiles, the permission
registry entry, the settings section, and radicale from every package list.

three platform things had to change first, each committed on its own:
6b5c87da a plugin can be more than one screen; e0df28ff a first-party plugin can
claim a reserved root path. this commit adds the third, `personal` on a plugin
permission — a member granted READ must still mint and revoke their own app
password, because that password is how their own phone reaches their own
calendar. those rows are theirs and nobody else's.

two fixes the work surfaced rather than caused. the dock pinned mountPrefix, so
a multi-screen plugin pinned a tile pointing at /caldav — a route no plugin
serves. and the OPTIONS carve-out was a literal list of four DAV paths; it asks
the claim registry now, so it follows whoever owns the route.

/calendar stays in DEFAULT_DOCK_PATHS. it is installed by default and a fresh
dock that silently dropped it would read as a downgrade.

docs:check earned its keep twice here: it caught spotlight still offering
/settings/integrations/dav-app-passwords after the section was deleted, and the
permission count going 22 -> 21. neither is greppable and both were already wrong
when it ran.

verified against alpha, which is still on the pre-extraction code: /.well-known/
caldav 301s, /dav/ answers 401 with the same WWW-Authenticate realm byte for
byte, /api/caldav/passwords 401s, and OPTIONS reaches the DAV router rather than
being answered as a CORS preflight. installed here end to end — schema applied,
sidecar started, two tiles with their own artwork behind one permission.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

src/servers/plugins/mount.ts

@@ -14,7 +14,7 @@ import {
 import { discoverPlugins } from './discover';
 import { mountPrefix, type DiscoveredPlugin } from './manifest';
 import { generatePluginsModule, rebuildFrontend } from './generate';
-import { iconUrl } from '../app-store/assets';
+import { iconUrl, screenArtUrl } from '../app-store/assets';
 import { publishAssets } from '../app-store/assets';
 import { importFresh } from './import-fresh';
 
@@ -139,6 +139,10 @@ function pluginPermissions(state: PluginState): Permission[] {
     api: index === 0 ? [prefix] : [],
     routes: index === 0 ? [prefix] : [],
     ...(permission.readOnlyWrites ? { readOnlyWrites: permission.readOnlyWrites } : {}),
+    // Rows only the caller can see, so a read grant may still write them — a member minting the app
+    // password their own phone syncs with. Threaded like the two below, and meaningful for the same
+    // reason: only the entry that claims the paths can match anything.
+    ...(permission.personal ? { personal: permission.personal } : {}),
     // Only meaningful on the entry that claims the paths — a later permission claims no `api`, so an
     // `ownerOnly` on it would match nothing. Threaded anyway rather than dropped: silently ignoring a
     // declaration is how a plugin author concludes the field does not work.
@@ -309,13 +313,18 @@ export async function pluginDockManifests(): Promise<
           // A plugin with several screens is the one case where the shared artwork is WRONG: two
           // identical tiles side by side say nothing about which is which. So a screen naming its own
           // glyph overrides the image, and one that does not falls back to the plugin's.
-          ...(screen.icon && plugin.web!.screens.length > 1
-            ? { icon: screen.icon }
-            : plugin.icon
+          // Order: this screen's own artwork, then the plugin's, then a glyph. The middle one is skipped
+          // for a multi-screen plugin that gave this screen no art of its own — two identical tiles say
+          // nothing about which is which, and a distinct glyph beats a repeated picture.
+          ...(screen.art
+            ? { image: screenArtUrl(plugin.appName, screen.segment!) }
+            : plugin.icon && plugin.web!.screens.length === 1
               ? { image: iconUrl(plugin.appName) }
               : { icon: screen.icon ?? plugin.manifest.icon }),
           // Artwork defaults to `bare`, a glyph to `badge`; the manifest overrides either way.
-          tile: plugin.manifest.tile ?? (plugin.icon && plugin.web!.screens.length === 1 ? 'bare' : 'badge'),
+          tile:
+            plugin.manifest.tile ??
+            (screen.art || (plugin.icon && plugin.web!.screens.length === 1) ? 'bare' : 'badge'),
           color: plugin.manifest.color,
           rootRoute: route,
           routes: [route],