#28 · iCal feed per-user (`/ical/<token>.ics`) for personal calendar sync

Context

Members RSVP to events but can't easily get them in Apple/Google Calendar. A signed iCal feed token lets users subscribe to their own events.

Acceptance criteria

• [ ] User profile generates a one-time iCal token, stored in users.ical_token
• [ ] GET /ical/<token>.ics returns RFC 5545 iCal of all RSVPed events for that user
• [ ] Token rotation: profile page has "Regenerate token" button (invalidates old URL)
• [ ] Cache-Control: max-age=3600 (calendars poll hourly)
• [ ] Includes recurring events properly (RRULE)

Technical hints

• Need a tiny iCal serializer — DON'T pull in ical-generator (heavy); 100 lines of Hono-native code is enough
• DTSTAMP / UID are required by RFC, missing them breaks Apple Calendar
• Always set explicit timezone (America/New_York) per global timezone rule

--- *Submit a merge request that says Closes #<this issue iid> in the description. On merge to main, the GitLab webhook will auto-award your bounty + the standard merge_pr (40 pts) to your scoreboard account. Email on commit must match your Authentik email.*