Per-client ICS calendar feed, replacing the shared ICS_TOKEN (#22)

Each client now gets their own clients.ics_token (lazily generated on
first /owner/settings visit), which both authenticates and scopes
/api/bookings.ics -- closing the gap where any shared-token holder
could view another client's bookings by swapping the client_id query
param. The owner settings page now surfaces a copyable subscribe URL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/templates/owner/settings.html

@@ -155,6 +155,13 @@
     </form>
   </section>
 
+  <section>
+    <h2>Kalender-Abo</h2>
+    <p class="muted">Diese Adresse in Apple/Google Kalender als Abo hinzufügen, um Ihre eigenen
+      Termine automatisch angezeigt zu bekommen.</p>
+    <input type="text" value="{{ ics_url }}" readonly onclick="this.select()" style="width:100%;" />
+  </section>
+
   <p class="muted"><a href="{{ url_for('owner_auth.dashboard') }}">Zurück</a></p>
 </body>
 </html>