An unparseable VEVENT inside a CalDAV multistatus response was silently
discarded, so a partial sync failure looked identical to a calendar with
fewer events. It now logs a WARN with the VEVENT's UID (if extractable)
and a short parse-error reason, never the raw calendar body.
CalDAV and CardDAV round trips are wrapped in spans and log completion
counts (fetched/parsed/dropped) keyed by account/calendar id only.
Additive SQLite column migrations and first-use vault key minting now
log at INFO, naming the table/column or key purpose without ever
exposing key material.
CalDavAccountConfig and CardDavAccountConfig held an auth_token behind a
derived Debug, which would have printed the raw token verbatim from any
future debug! log or panic message. Both now use a manual Debug impl
that redacts the token.
Refs #362
James Maes