sync(chunk 3): the sync engine

Full bidirectional sync, correct but not yet clever: calendar-query with no
time-range, calendar-multiget in batches matched against what was asked for,
conditional writes, and per-resource quarantine so one bad task cannot stop a
collection.

- :caldav gains CalendarCollection (list/fetch/create/update/delete + the
  three-way 412 triage), ETag with its weak flag, vdirsyncer-style resource
  names, and the RemoteCalendar seam.
- CalDavHttp now sends Accept-Encoding: identity and Prefer: handling=strict,
  the two headers that keep ETags strong and our bytes unrepaired.
- :app gains CollectionSyncer (the reconciliation), SyncEngine, SyncStore,
  QuarantineStore, SyncReport and a working SyncWorker, plus an in-app sync
  trigger since ContentResolver.requestSync is gated at our targetSdk.
- VTimeZones closes a chunk-1 gap: the mapper emitted TZID with no VTIMEZONE
  to resolve it, which handling=strict turns from a repair into a rejection.

/code-review high raised 11 findings, all fixed. The three that mattered:
an empty listing swept the whole list (a VTODO comp-filter some servers
mishandle is not proof of deletion, so an empty listing now never sweeps);
quarantine never covered creates, so a permanently rejected new task was
re-PUT forever; and a RELATED-TO deleted on the server was re-uploaded on the
next edit. Reasoning recorded in docs/SYNC-PLAN.md.

Chunk 2's on-device review is still outstanding; nothing here has been run on
a device or against a real server.

app/src/main/res/values/strings.xml

@@ -307,6 +307,7 @@
     <string name="accounts_remove_confirm_action">Remove</string>
     <string name="accounts_never_synced">Never synced</string>
     <string name="accounts_sync_failed">Last sync didn\u2019t finish</string>
+    <string name="accounts_sync_now">Sync now</string>
 
     <string name="add_account_title">Add an account</string>
     <string name="add_account_server_label">Email address or server address</string>