chore(web): add RobertSmits to the contributor carousel (#405)

Adds a 96x96 WebP avatar (matching the existing contributor assets) and the
contributors.json entry.

fix(sync): stop gating sync on needsReauthentication (#404)

The needsReauthentication flag is being set on accounts whose credentials are
actually valid. Because a flagged account/calendar is filtered out of every
sync, source-selection and credential-resolution query, this silently breaks
syncing — and a flagged push destination can never run a push to recover, so
it stays stuck in one direction.

Remove all needsReauthentication gates from the sync paths (push destinations,
CalDAV/Google/Outlook source selection, OAuth account selection, and API
credential resolution). The flag is still written and surfaced in the UI; it
just no longer hard-blocks syncing.

fix(ical): emit feed EXDATE and RRULE UNTIL in UTC to match DTSTART (#…

…397)

* fix(ical): emit feed EXDATE and RRULE UNTIL in UTC to match DTSTART

The public ICS feed serializes DTSTART/DTEND as bare UTC (...Z), but
source-parsed exceptionDates and RRULE UNTIL carried the source's TZID
(the ts-ics `local` block). Emitting EXDATE;TZID=America/Montevideo against
a UTC DTSTART is an RFC 5545 value-type mismatch: Apple Calendar drops the
entire recurring event when it can't reconcile an IANA-TZID EXDATE with a
UTC DTSTART. Events whose EXDATE used an unrecognized Windows zone name
survived because Apple silently ignored it — hence the inconsistency where
some recurring events rendered and others vanished.

Normalize exceptionDates and recurrenceRule.until to bare UTC (strip the
`local` block) so they match the feed's UTC DTSTART, preserving the
underlying instant and keeping VALUE=DATE for all-day exceptions.

Regression tests cover EXDATE and UNTIL carrying a TZID.

* style(api): use block comment to satisfy capitalized-comments lint

oxlint's capitalized-comments rule flags each // line individually, so
the lowercase continuation line failed CI lint. Convert the EXDATE
regression comment to a block comment, matching the sibling regression
comment already in this file.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Rida F'kih <github.com@rida.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(calendar): surface Microsoft API error details and correct paging…

… error (#399)

* fix(calendar): surface Microsoft API error details and correct paging error

* fix(outlook): import MicrosoftApiError from the provider types module

The type is declared in providers/outlook/types.ts, not in the
source/types.ts that "../types" resolves to from source/utils/, so
the import failed type-checking (TS2305) and broke @keeper.sh/sync's
build. Point the import at "../../types" where MicrosoftApiError —
the { code?: string } shape consumed by isAuthError — is exported.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Rida F'kih <github.com@rida.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(ics): don't wipe existing events when remote fetch fails (#383)

chore: add conflict-lookup diagnostics to google push sync (#402)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(calendar): consider events with changed content stale (#393)

* fix(calendar): consider events with changed content stale

* refactor(calendar): require nullable title/description/location for ingest

feat(ics): add ics parsing leniency for date strings (#392)

* feat(ics): add ics parsing leniency for date strings

* fix: close gaps in date coercion

* fix(ics): make calendar date coercion more robust

* fix: apply lenient parsing to pullRemoteCalendar

chore(web): add new collaborator @agurod42 (#390)

ci: pin sha commit of sensitive workflows (#389)

* ci: pin sha commit of sensitive workflows

* fixup! ci: pin sha commit of sensitive workflows