feat(caldav): add token_hash column and store SHA-256 hashed tokens

server/routes/calendar.js

@@ -723,9 +723,10 @@ router.post('/caldav-tokens', authenticateToken, async (req, res) => {
       return res.status(400).json({ error: 'Maximum of 10 tokens allowed' });
     }
     const token = crypto.randomBytes(32).toString('hex');
+    const tokenHash = crypto.createHash('sha256').update(token).digest('hex');
     const result = await db.run(
-      'INSERT INTO caldav_tokens (user_id, token, name) VALUES (?, ?, ?)',
-      [req.user.id, token, name.trim()],
+      'INSERT INTO caldav_tokens (user_id, token, token_hash, name) VALUES (?, ?, ?, ?)',
+      [req.user.id, token, tokenHash, name.trim()],
     );
     res.status(201).json({
       token: { id: result.lastInsertRowid, name: name.trim() },