fix: harden calendar subscriptions and add left-swipe reopen

tests/test_mvp_backend.py

@@ -34,6 +34,59 @@ def test_calendar_endpoint_is_removed(client):
     assert client.get("/api/v1/calendar", params={"start": "2026-09-01", "end": "2026-09-30"}).status_code == 404
 
 
+def test_calendar_parser_handles_tzid_recurrence_folding_and_multiday():
+    from backend.mvp import parse_ics_events
+
+    ics = """BEGIN:VCALENDAR\r
+VERSION:2.0\r
+BEGIN:VEVENT\r
+UID:tzid-recurring\r
+DTSTART;TZID=Asia/Shanghai:20260906T090000\r
+DTEND;TZID=Asia/Shanghai:20260906T100000\r
+RRULE:FREQ=DAILY;COUNT=2\r
+EXDATE;TZID=Asia/Shanghai:20260907T090000\r
+SUMMARY:折叠\r
+ 标题\r
+END:VEVENT\r
+BEGIN:VEVENT\r
+UID:multi-day\r
+DTSTART;TZID=Asia/Shanghai:20260905T230000\r
+DTEND;TZID=Asia/Shanghai:20260906T010000\r
+SUMMARY:跨天事件\r
+END:VEVENT\r
+END:VCALENDAR\r
+"""
+    events = parse_ics_events(
+        ics,
+        "测试日历",
+        "#fff",
+        datetime(2026, 9, 5, 16, tzinfo=UTC),
+        datetime(2026, 9, 6, 16, tzinfo=UTC),
+    )
+
+    assert [(row["title"], row["starts_at"].isoformat()) for row in events] == [
+        ("折叠标题", "2026-09-06T01:00:00+00:00"),
+        ("跨天事件", "2026-09-05T15:00:00+00:00"),
+    ]
+
+
+def test_calendar_url_rejects_private_addresses(monkeypatch):
+    from fastapi import HTTPException
+
+    from backend.mvp import _validated_calendar_target
+
+    monkeypatch.setattr(
+        "backend.mvp.socket.getaddrinfo",
+        lambda *_args, **_kwargs: [(None, None, None, None, ("127.0.0.1", 80))],
+    )
+    try:
+        _validated_calendar_target("http://example.com/calendar.ics")
+    except HTTPException as exc:
+        assert exc.status_code == 422
+    else:
+        raise AssertionError("private calendar target should be rejected")
+
+
 def test_recurrence_mutations_keep_exact_timestamp_validation(client):
     inbox = boot(client)
     task = client.post(