Harden admin mutations and calendar color rendering

[AnnoyingTechnology]

Why

Several browser-admin actions currently mutate state through unrestricted routes, with some invoked through GET requests. Because these custom actions sit outside Symfony Forms, they also bypass the built-in CSRF protection.

Calendar colors can also be written through DAV without Symfony validation and are rendered directly into inline CSS. SQLite does not enforce the declared VARCHAR length, so the database schema does not bound that value.

This PR establishes the standard boundary for the admin interface: reads use GET, form handlers use GET/POST, state-changing actions require POST with a valid CSRF token, and stored calendar colors are allowlisted before entering a CSS context.

The rendering check closes the CSS sink for existing data and every current write path. Validating colors when they are written remains a desirable follow-up so malformed values are rejected instead of being stored inertly.

What changed

• constrain every browser-admin route to its intended HTTP methods
• require POST and CSRF validation for deletion, sharing, revocation, and delegation changes
• protect logout with POST and Symfony logout CSRF validation
• replace query-string mutation links with ordinary POST forms
• restrict mutation parameters to the POST body
• render calendar and subscription colors only when they exactly match #RRGGBB or #RRGGBBAA
• omit the inline style for invalid stored colors
• cover both rejected requests and successful share, revoke, delegate, delete, logout, and color-rendering flows

DAV and API endpoints are unchanged; they retain their existing protocol-specific authentication, storage behavior, and HTTP methods.

Verification

• PHPUnit: 64 tests, 466 assertions
• explicit coverage for every custom admin mutation route
• successful calendar sharing/revocation and delegate addition/removal
• valid calendar colors render unchanged; CSS declarations do not reach the inline style
• Twig, YAML, container, JavaScript, Composer, PHP style, syntax, and whitespace checks