v0.20.37

Added

• server/services/ics-subscription.js: core ICS subscription service with SSRF-protected fetch (DNS pre-resolution against private IP ranges), ETag/Last-Modified conditional fetching, 10 MB response size limit, 15 s timeout, webcal:// → https:// normalization, RRULE expansion via sync window (−6 / +12 months), upsert-on-conflict with user_modified guard, stale-event cleanup via json_each, and in-memory mutex to prevent concurrent syncs of the same subscription