fix: harden sync backends and fix edit recompute (#66)

* refactor(oauth): async coroutine support, pure-Lua PKCE, server hardening

Problem: OAuth module shelled out to openssl for PKCE, used blocking
`vim.system():wait()`, had a weak `os.time()` PRNG seed, and the TCP
callback server leaked on read errors with no timeout.

Solution: Add `M.system()` coroutine wrapper and `M.async()` helper,
replace openssl with `vim.fn.sha256` + `vim.base64.encode`, seed from
`vim.uv.hrtime()`, add `close_server()` guard with 120s timeout, and
close the server on read errors.

* fix(gtasks): async operations, error notifications, buffer refresh

Problem: Sync operations blocked the editor, `push_pass` silently
dropped delete/update/create API errors, and the buffer was not
re-rendered after push/pull/sync.

Solution: Wrap `push`, `pull`, `sync` in `oauth.async()`, add
`vim.notify` for all `push_pass` failure paths, and re-render the
pending buffer after each operation.

* fix(init): edit recompute, filter predicates, sync action listing

Problem: `M.edit()` skipped `_recompute_counts()` after saving,
`compute_hidden_ids` lacked `done`/`pending` predicates, and
`run_sync` defaulted to `sync` instead of listing available actions.

Solution: Replace `s:save()` with `_save_and_notify()` in `M.edit()`,
add `done` and `pending` filter predicates, and list backend actions
when no action is specified.

* refactor(gcal): per-category calendars, async push, error notifications

Problem: gcal used a single hardcoded calendar name, ran synchronously
blocking the editor, and silently dropped some API errors.

Solution: Fetch all calendars and map categories to calendars (creating
on demand), wrap push in `oauth.async()`, notify on individual API
failures, track `_gcal_calendar_id` in `_extra`, and remove the `$`
anchor from `next_day` pattern.

* refactor: formatting fixes, config cleanup, health simplification

Problem: Formatter disagreements in `init.lua` and `gtasks.lua`,
stale `calendar` field in gcal config, and redundant health checks
for data directory existence.

Solution: Apply stylua formatting, remove `calendar` field from
`pending.GcalConfig`, drop data-dir and no-file health messages,
add `done`/`pending` to filter tab-completion candidates.

* docs: update vimdoc for sync refactor, remove demo scripts

Problem: Docs still referenced openssl dependency, defaulting to `sync`
action, and the `calendar` config field. Demo scripts used the old
singleton `store` API.

Solution: Update vimdoc and README to reflect explicit actions, per-
category calendars, and pure-Lua PKCE. Remove stale demo scripts and
update sync specs to match new behavior.

* fix(types): correct LuaLS annotations in oauth and gcal

lua/pending/init.lua

@@ -142,6 +142,16 @@ local function compute_hidden_ids(tasks, predicates)
           visible = false
           break
         end
+      elseif pred == 'done' then
+        if task.status ~= 'done' then
+          visible = false
+          break
+        end
+      elseif pred == 'pending' then
+        if task.status ~= 'pending' then
+          visible = false
+          break
+        end
       end
     end
     if not visible then
@@ -536,12 +546,22 @@ end
 ---@param action? string
 ---@return nil
 local function run_sync(backend_name, action)
-  action = (action and action ~= '') and action or 'sync'
   local ok, backend = pcall(require, 'pending.sync.' .. backend_name)
   if not ok then
     vim.notify('Unknown sync backend: ' .. backend_name, vim.log.levels.ERROR)
     return
   end
+  if not action or action == '' then
+    local actions = {}
+    for k, v in pairs(backend) do
+      if type(v) == 'function' and k:sub(1, 1) ~= '_' then
+        table.insert(actions, k)
+      end
+    end
+    table.sort(actions)
+    vim.notify(backend_name .. ' actions: ' .. table.concat(actions, ', '), vim.log.levels.INFO)
+    return
+  end
   if type(backend[action]) ~= 'function' then
     vim.notify(backend_name .. " backend has no '" .. action .. "' action", vim.log.levels.ERROR)
     return
@@ -804,7 +824,7 @@ function M.edit(id_str, rest)
 
   s:update(id, updates)
 
-  s:save()
+  _save_and_notify()
 
   local bufnr = buffer.bufnr()
   if bufnr and vim.api.nvim_buf_is_valid(bufnr) then
@@ -841,7 +861,7 @@ function M.command(args)
     local id_str, edit_rest = rest:match('^(%S+)%s*(.*)')
     M.edit(id_str, edit_rest)
   elseif SYNC_BACKEND_SET[cmd] then
-    local action = rest:match('^(%S+)') or 'sync'
+    local action = rest:match('^(%S+)')
     run_sync(cmd, action)
   elseif cmd == 'archive' then
     local d = rest ~= '' and tonumber(rest) or nil