[grade=B urn:ump:dbxmyhvr7cpkeu3mbfdevrco7utsok743udjsj7atih6qk4frdiq] fix(DC-168): calendar widget CSRF writes, error path, modal UX (audit batch 2)

Audit 2026-10-27 fixes (46-finding sweep, AUDIT-2026-10-27.md):
- P0-2: all 6 calendar API calls via secureFetch — raw fetch sent no
  X-CSRF-Token so every mutation (save/toggle/delete/test) was rejected
  403 [DC-100]; GETs gain the standard 15s timeout
- P0-6: refresh() catch called nonexistent errorHandler.log() — the
  error path itself threw; now logError(context, error)
- P0-7: modal sizing off inline min-width:560px onto .cal-modal-content
  with 768px override (inline style beat the mobile media query)
- refresh coalescing via _pendingForce (forced refreshes were dropped
  mid-flight); single fetch sequence on modal open; toggle/delete get
  resp.ok + try/catch + toast + disabled-during-flight
- modal on class-based .show: click-outside, Escape, focus move/return
  on all three dismissal paths (judge polish applied)
- chip honors Enter/Space (role=button); poll skips hidden tabs
- --cal-chip-when/--cal-when/--cal-dot re-scoped to :root (were scoped
  to elements that are never ancestors of .cal-dot — DC-168 WCAG dot
  colors never rendered)
- calendar-cache eventKey no longer throws RangeError on invalid start

Bundles rebuilt (sw dashcaddy-shell-7fc13e7762). status suite 68/68.
Judge B (polish items applied pre-commit): urn:ump:dbxmyhvr7cpkeu3mbfdevrco7utsok743udjsj7atih6qk4frdiq

status/css/dashboard.css

@@ -4343,16 +4343,26 @@ button:focus-visible {
    when the active theme's background is light (luminance > 0.4) — this covers
    builtin AND user themes with no per-slug rules. On dark surfaces, small
    accent text is lightened via color-mix; on light surfaces the raw accent
-   (dark tones) is correct. */
-:root:not(.light-bg) .calendar-widget .cal-chip-when,
-:root:not(.light-bg) .cal-when {
+   (dark tones) is correct.
+   Audit 2026-10-27: the custom properties are declared on :root (they were
+   scoped to .cal-chip-when/.cal-when elements, which are never ancestors of
+   .cal-dot inside the modal grid — the tuned dot colors never rendered). */
+:root:not(.light-bg) {
   --cal-chip-when: color-mix(in srgb, var(--accent) 20%, white);
   --cal-when: color-mix(in srgb, var(--accent) 20%, white);
   --cal-dot: color-mix(in srgb, var(--accent) 75%, white);
 }
-:root.light-bg .calendar-widget .cal-chip-when,
-:root.light-bg .cal-when {
+:root.light-bg {
   --cal-chip-when: color-mix(in srgb, var(--accent) 72%, black);
   --cal-when: color-mix(in srgb, var(--accent) 72%, black);
   --cal-dot: color-mix(in srgb, var(--accent) 72%, black);
 }
+
+/* ========== Calendar modal sizing (audit 2026-10-27) ==========
+   Sizing moved off the inline style (inline min-width:560px beat the mobile
+   media query and overflowed phones) onto a class, with a mobile override
+   matching the app-wide 768px breakpoint. */
+.cal-modal-content { min-width: 560px; max-width: 720px; }
+@media (max-width: 768px) {
+  .cal-modal-content { min-width: 0; max-width: 100%; }
+}