Per-client ICS calendar feed, replacing the shared ICS_TOKEN (#22)

Each client now gets their own clients.ics_token (lazily generated on
first /owner/settings visit), which both authenticates and scopes
/api/bookings.ics -- closing the gap where any shared-token holder
could view another client's bookings by swapping the client_id query
param. The owner settings page now surfaces a copyable subscribe URL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/owner_settings.py

@@ -61,9 +61,11 @@ def settings():
     hours_by_resource = {
         r["resource_id"]: bdb.get_resource_hours(client_id, r["resource_id"])
         for r in resources}
+    ics_token = bdb.ensure_ics_token(client_id)
     return render_template(
         "owner/settings.html", client=client, services=bdb.list_services(client_id),
         resources=resources, hours_by_resource=hours_by_resource, weekdays=WEEKDAYS,
+        ics_url=url_for("bookings_ics", token=ics_token, _external=True),
         error=request.args.get("error"))