Let other apps write to the own store through the provider (#64)

Builds on the read-only provider (#62) and makes it writable for other apps, as long as Agendula uses its own store.

- `tasks`: insert, update and delete. Writes follow the same rules as the app's own edits. Status, progress and completion time stay consistent, a subtree moves and deletes as one, and a write that changes nothing doesn't mark the task for sync.
- `instances`: completion columns complete, cancel or reopen that one occurrence. Other content columns edit the whole series. Changing a time column is rejected, so a series is moved through `tasks`.
- `properties`: alarms and categories can be inserted, updated and deleted.
- `tasklists` stays read-only. Batches run in one transaction.
- A client can write back a row it read. Columns it carries unchanged are ignored, and so are rdate/exdate values in the shape they were synced in.
- A task inserted with a time but no `tz` is floating, as in OpenTasks.
- Deleting a task now takes its whole subtree in the app as well, including "this and following" from the first occurrence and in External mode.

Deviation: tag property ids stay stable, with one rare exception. If two tags on one task have hash-colliding spellings, removing one can shift the other's id. Avoiding that would mean storing the ids, which didn't seem worth it at about a 1 in 2³¹ chance.

Closes #63

Co-authored-by: Jean-Luc Makiola <business@jeanlucmakiola.de>
Reviewed-on: https://codeberg.org/jlmakiola/agendula/pulls/64

docs/PRIVACY.md

@@ -55,7 +55,8 @@ All of this is verifiable in the
 - **On your device (the default)** — your task lists, tasks and reminders are
   kept in Agendula's own database inside the app's private storage, and
   uninstalling the app removes it. Another app can read these tasks only if you
-  grant it Agendula's "read Agendula tasks" permission (see section 9).
+  grant it Agendula's "read Agendula tasks" permission, and change them only if
+  you grant it "add, change and delete Agendula tasks" (see section 9).
 - **In a tasks provider you already use** — OpenTasks or tasks.org. Agendula
   then reads and writes that app's task database through Android's provider
   mechanism, after you grant its read/write permission. Whatever already
@@ -210,13 +211,20 @@ source:
   used for scheduled background work (WorkManager); on older Android versions
   it needs them to run an expedited sync.
 
-Agendula declares one permission that other apps can request:
-`de.jeanlucmakiola.agendula.permission.READ_TASKS`. Android asks you before
-granting it, and you can revoke it at any time in the system settings. An app
-that holds it can read your task lists, tasks, reminders and tags from
-Agendula's own database (read-only, and nothing while Agendula works on top of
-an external tasks provider). What that app then does with them is governed by
-its own privacy policy.
+Agendula declares two permissions that other apps can request. Android asks you
+before granting either, and you can revoke them at any time in the system
+settings.
+
+- `de.jeanlucmakiola.agendula.permission.READ_TASKS`: an app that holds it can
+  read your task lists, tasks, reminders and tags from Agendula's own database.
+- `de.jeanlucmakiola.agendula.permission.WRITE_TASKS`: an app that holds it can
+  add, change, complete and delete those tasks, reminders and tags. It cannot
+  change or delete task lists. Its changes sync to your CalDAV server like your
+  own edits.
+
+Neither gives access to anything while Agendula works on top of an external
+tasks provider. What an app does with your tasks is governed by its own privacy
+policy.
 
 ## 10. Distribution channels