Tribu 1.4.0

Highlights

• CalDAV + CardDAV phone sync: calendars and the shared family address book are now reachable over standard DAV clients (iOS, macOS Calendar/Contacts, Android via DAVx5). A new Phone Sync tab in settings lists the per-family URLs with iOS and Android setup guidance. PATs authenticate both protocols with scope-aware rights enforcement, and writes are serialized so If-Match stays atomic. (#55)
• Weekly meal planning: new module with weekly grid view, ingredient autocomplete, drag-and-drop between slots, and direct push to the shopping list with per-ingredient format normalization. Includes a structured-ingredients schema and unique-slot constraint.
• Gifts module polish: segmented status control with full a11y labels, sort + recipient grouping, upcoming-birthday prefill, rich empty state, dialog-based form, and correct nav visibility on reset.

Security

• Personal Access Tokens are now stored as bcrypt envelopes with a dedicated rotation-safe token_lookup column for indexed equality search. Legacy SHA-256 tokens keep working and are rewritten to bcrypt on their next successful authentication, so no user action is required. Rotating JWT_SECRET no longer invalidates existing PATs. Migration 0027_pat_bcrypt_migration handles the schema change and backfills the lookup column. (#151)

Fixes

• Rewards row now appears in Settings > Navigation and can be reordered like any other section (#149).
• vobject-backed vCard round-trip and UID hijack guard on CardDAV writes.
• updated_at on calendar_events drives DAV cache invalidation on full-refresh paths.
• Phone sync tab accessibility labels and proper German umlauts.
• Meal plans DnD handle split from the edit button for touch and keyboard users.