fix: harden sync backends and fix edit recompute (#66)

* refactor(oauth): async coroutine support, pure-Lua PKCE, server hardening

Problem: OAuth module shelled out to openssl for PKCE, used blocking
`vim.system():wait()`, had a weak `os.time()` PRNG seed, and the TCP
callback server leaked on read errors with no timeout.

Solution: Add `M.system()` coroutine wrapper and `M.async()` helper,
replace openssl with `vim.fn.sha256` + `vim.base64.encode`, seed from
`vim.uv.hrtime()`, add `close_server()` guard with 120s timeout, and
close the server on read errors.

* fix(gtasks): async operations, error notifications, buffer refresh

Problem: Sync operations blocked the editor, `push_pass` silently
dropped delete/update/create API errors, and the buffer was not
re-rendered after push/pull/sync.

Solution: Wrap `push`, `pull`, `sync` in `oauth.async()`, add
`vim.notify` for all `push_pass` failure paths, and re-render the
pending buffer after each operation.

* fix(init): edit recompute, filter predicates, sync action listing

Problem: `M.edit()` skipped `_recompute_counts()` after saving,
`compute_hidden_ids` lacked `done`/`pending` predicates, and
`run_sync` defaulted to `sync` instead of listing available actions.

Solution: Replace `s:save()` with `_save_and_notify()` in `M.edit()`,
add `done` and `pending` filter predicates, and list backend actions
when no action is specified.

* refactor(gcal): per-category calendars, async push, error notifications

Problem: gcal used a single hardcoded calendar name, ran synchronously
blocking the editor, and silently dropped some API errors.

Solution: Fetch all calendars and map categories to calendars (creating
on demand), wrap push in `oauth.async()`, notify on individual API
failures, track `_gcal_calendar_id` in `_extra`, and remove the `$`
anchor from `next_day` pattern.

* refactor: formatting fixes, config cleanup, health simplification

Problem: Formatter disagreements in `init.lua` and `gtasks.lua`,
stale `calendar` field in gcal config, and redundant health checks
for data directory existence.

Solution: Apply stylua formatting, remove `calendar` field from
`pending.GcalConfig`, drop data-dir and no-file health messages,
add `done`/`pending` to filter tab-completion candidates.

* docs: update vimdoc for sync refactor, remove demo scripts

Problem: Docs still referenced openssl dependency, defaulting to `sync`
action, and the `calendar` config field. Demo scripts used the old
singleton `store` API.

Solution: Update vimdoc and README to reflect explicit actions, per-
category calendars, and pure-Lua PKCE. Remove stale demo scripts and
update sync specs to match new behavior.

* fix(types): correct LuaLS annotations in oauth and gcal

lua/pending/sync/gcal.lua

@@ -15,13 +15,10 @@ local client = oauth.new({
   config_key = 'gcal',
 })
 
----@return string? calendar_id
+---@param access_token string
+---@return table<string, string>? name_to_id
 ---@return string? err
-local function find_or_create_calendar(access_token)
-  local cfg = config.get()
-  local gc = (cfg.sync and cfg.sync.gcal) or {}
-  local cal_name = gc.calendar or 'Pendings'
-
+local function get_all_calendars(access_token)
   local data, err = oauth.curl_request(
     'GET',
     BASE_URL .. '/users/me/calendarList',
@@ -30,27 +27,41 @@ local function find_or_create_calendar(access_token)
   if err then
     return nil, err
   end
-
+  local result = {}
   for _, item in ipairs(data and data.items or {}) do
-    if item.summary == cal_name then
-      return item.id, nil
+    if item.summary then
+      result[item.summary] = item.id
     end
   end
+  return result, nil
+end
 
-  local body = vim.json.encode({ summary = cal_name })
-  local created, create_err =
-    oauth.curl_request('POST', BASE_URL .. '/calendars', oauth.auth_headers(access_token), body)
-  if create_err then
-    return nil, create_err
+---@param access_token string
+---@param name string
+---@param existing table<string, string>
+---@return string? calendar_id
+---@return string? err
+local function find_or_create_calendar(access_token, name, existing)
+  if existing[name] then
+    return existing[name], nil
   end
-
-  return created and created.id, nil
+  local body = vim.json.encode({ summary = name })
+  local created, err =
+    oauth.curl_request('POST', BASE_URL .. '/calendars', oauth.auth_headers(access_token), body)
+  if err then
+    return nil, err
+  end
+  local id = created and created.id
+  if id then
+    existing[name] = id
+  end
+  return id, nil
 end
 
 ---@param date_str string
 ---@return string
 local function next_day(date_str)
-  local y, m, d = date_str:match('^(%d%d%d%d)-(%d%d)-(%d%d)$')
+  local y, m, d = date_str:match('^(%d%d%d%d)-(%d%d)-(%d%d)')
   local t = os.time({ year = tonumber(y) or 0, month = tonumber(m) or 0, day = tonumber(d) or 0 })
     + 86400
   return os.date('%Y-%m-%d', t) --[[@as string]]
@@ -128,74 +139,100 @@ function M.auth()
   client:auth()
 end
 
-function M.sync()
-  local access_token = client:get_access_token()
-  if not access_token then
-    return
-  end
+function M.push()
+  oauth.async(function()
+    local access_token = client:get_access_token()
+    if not access_token then
+      return
+    end
 
-  local calendar_id, err = find_or_create_calendar(access_token)
-  if err or not calendar_id then
-    vim.notify('pending.nvim: ' .. (err or 'calendar not found'), vim.log.levels.ERROR)
-    return
-  end
+    local calendars, cal_err = get_all_calendars(access_token)
+    if cal_err or not calendars then
+      vim.notify('pending.nvim: ' .. (cal_err or 'failed to fetch calendars'), vim.log.levels.ERROR)
+      return
+    end
 
-  local tasks = require('pending').store():tasks()
-  local created, updated, deleted = 0, 0, 0
+    local s = require('pending').store()
+    local created, updated, deleted = 0, 0, 0
 
-  for _, task in ipairs(tasks) do
-    local extra = task._extra or {}
-    local event_id = extra['_gcal_event_id'] --[[@as string?]]
+    for _, task in ipairs(s:tasks()) do
+      local extra = task._extra or {}
+      local event_id = extra['_gcal_event_id'] --[[@as string?]]
+      local cal_id = extra['_gcal_calendar_id'] --[[@as string?]]
 
-    local should_delete = event_id ~= nil
-      and (
-        task.status == 'done'
-        or task.status == 'deleted'
-        or (task.status == 'pending' and not task.due)
-      )
+      local should_delete = event_id ~= nil
+        and cal_id ~= nil
+        and (
+          task.status == 'done'
+          or task.status == 'deleted'
+          or (task.status == 'pending' and not task.due)
+        )
 
-    if should_delete and event_id then
-      local del_err = delete_event(access_token, calendar_id, event_id) --[[@as string]]
-      if not del_err then
-        extra['_gcal_event_id'] = nil
-        if next(extra) == nil then
-          task._extra = nil
+      if should_delete then
+        local del_err =
+          delete_event(access_token, cal_id --[[@as string]], event_id --[[@as string]])
+        if del_err then
+          vim.notify('pending.nvim: gcal delete failed: ' .. del_err, vim.log.levels.WARN)
         else
-          task._extra = extra
-        end
-        task.modified = os.date('!%Y-%m-%dT%H:%M:%SZ') --[[@as string]]
-        deleted = deleted + 1
-      end
-    elseif task.status == 'pending' and task.due then
-      if event_id then
-        local upd_err = update_event(access_token, calendar_id, event_id, task)
-        if not upd_err then
-          updated = updated + 1
-        end
-      else
-        local new_id, create_err = create_event(access_token, calendar_id, task)
-        if not create_err and new_id then
-          if not task._extra then
-            task._extra = {}
+          extra['_gcal_event_id'] = nil
+          extra['_gcal_calendar_id'] = nil
+          if next(extra) == nil then
+            task._extra = nil
+          else
+            task._extra = extra
           end
-          task._extra['_gcal_event_id'] = new_id
           task.modified = os.date('!%Y-%m-%dT%H:%M:%SZ') --[[@as string]]
-          created = created + 1
+          deleted = deleted + 1
+        end
+      elseif task.status == 'pending' and task.due then
+        local cat = task.category or config.get().default_category
+        if event_id and cal_id then
+          local upd_err = update_event(access_token, cal_id, event_id, task)
+          if upd_err then
+            vim.notify('pending.nvim: gcal update failed: ' .. upd_err, vim.log.levels.WARN)
+          else
+            updated = updated + 1
+          end
+        else
+          local lid, lid_err = find_or_create_calendar(access_token, cat, calendars)
+          if lid_err or not lid then
+            vim.notify(
+              'pending.nvim: gcal calendar failed: ' .. (lid_err or 'unknown'),
+              vim.log.levels.WARN
+            )
+          else
+            local new_id, create_err = create_event(access_token, lid, task)
+            if create_err then
+              vim.notify('pending.nvim: gcal create failed: ' .. create_err, vim.log.levels.WARN)
+            elseif new_id then
+              if not task._extra then
+                task._extra = {}
+              end
+              task._extra['_gcal_event_id'] = new_id
+              task._extra['_gcal_calendar_id'] = lid
+              task.modified = os.date('!%Y-%m-%dT%H:%M:%SZ') --[[@as string]]
+              created = created + 1
+            end
+          end
         end
       end
     end
-  end
 
-  require('pending').store():save()
-  require('pending')._recompute_counts()
-  vim.notify(
-    string.format(
-      'pending.nvim: Synced to Google Calendar (created: %d, updated: %d, deleted: %d)',
-      created,
-      updated,
-      deleted
+    s:save()
+    require('pending')._recompute_counts()
+    local buffer = require('pending.buffer')
+    if buffer.bufnr() and vim.api.nvim_buf_is_valid(buffer.bufnr()) then
+      buffer.render(buffer.bufnr())
+    end
+    vim.notify(
+      string.format(
+        'pending.nvim: Google Calendar pushed — +%d ~%d -%d',
+        created,
+        updated,
+        deleted
+      )
     )
-  )
+  end)
 end
 
 ---@return nil