999.10: in-app admin UI to manage app passwords + designate the shared
calendar (replaces manual is_shared DB write, D-16).
999.11: first-run setup wizard for env vars/VAPID/DB/app-password with
validation (motivated by the truncated-VAPID-key setup friction).
