fix: harden sync backends and fix edit recompute (#66)

* refactor(oauth): async coroutine support, pure-Lua PKCE, server hardening

Problem: OAuth module shelled out to openssl for PKCE, used blocking
`vim.system():wait()`, had a weak `os.time()` PRNG seed, and the TCP
callback server leaked on read errors with no timeout.

Solution: Add `M.system()` coroutine wrapper and `M.async()` helper,
replace openssl with `vim.fn.sha256` + `vim.base64.encode`, seed from
`vim.uv.hrtime()`, add `close_server()` guard with 120s timeout, and
close the server on read errors.

* fix(gtasks): async operations, error notifications, buffer refresh

Problem: Sync operations blocked the editor, `push_pass` silently
dropped delete/update/create API errors, and the buffer was not
re-rendered after push/pull/sync.

Solution: Wrap `push`, `pull`, `sync` in `oauth.async()`, add
`vim.notify` for all `push_pass` failure paths, and re-render the
pending buffer after each operation.

* fix(init): edit recompute, filter predicates, sync action listing

Problem: `M.edit()` skipped `_recompute_counts()` after saving,
`compute_hidden_ids` lacked `done`/`pending` predicates, and
`run_sync` defaulted to `sync` instead of listing available actions.

Solution: Replace `s:save()` with `_save_and_notify()` in `M.edit()`,
add `done` and `pending` filter predicates, and list backend actions
when no action is specified.

* refactor(gcal): per-category calendars, async push, error notifications

Problem: gcal used a single hardcoded calendar name, ran synchronously
blocking the editor, and silently dropped some API errors.

Solution: Fetch all calendars and map categories to calendars (creating
on demand), wrap push in `oauth.async()`, notify on individual API
failures, track `_gcal_calendar_id` in `_extra`, and remove the `$`
anchor from `next_day` pattern.

* refactor: formatting fixes, config cleanup, health simplification

Problem: Formatter disagreements in `init.lua` and `gtasks.lua`,
stale `calendar` field in gcal config, and redundant health checks
for data directory existence.

Solution: Apply stylua formatting, remove `calendar` field from
`pending.GcalConfig`, drop data-dir and no-file health messages,
add `done`/`pending` to filter tab-completion candidates.

* docs: update vimdoc for sync refactor, remove demo scripts

Problem: Docs still referenced openssl dependency, defaulting to `sync`
action, and the `calendar` config field. Demo scripts used the old
singleton `store` API.

Solution: Update vimdoc and README to reflect explicit actions, per-
category calendars, and pure-Lua PKCE. Remove stale demo scripts and
update sync specs to match new behavior.

* fix(types): correct LuaLS annotations in oauth and gcal

spec/sync_spec.lua

@@ -49,27 +49,27 @@ describe('sync', function()
       assert.are.equal("gcal backend has no 'notreal' action", msg)
     end)
 
-    it('defaults to sync action when action is omitted', function()
-      local called = false
-      local gcal = require('pending.sync.gcal')
-      local orig_sync = gcal.sync
-      gcal.sync = function()
-        called = true
+    it('lists actions when action is omitted', function()
+      local msg = nil
+      local orig = vim.notify
+      vim.notify = function(m)
+        msg = m
       end
       pending.command('gcal')
-      gcal.sync = orig_sync
-      assert.is_true(called)
+      vim.notify = orig
+      assert.is_not_nil(msg)
+      assert.is_truthy(msg:find('push'))
     end)
 
-    it('routes explicit sync action', function()
+    it('routes explicit push action', function()
       local called = false
       local gcal = require('pending.sync.gcal')
-      local orig_sync = gcal.sync
-      gcal.sync = function()
+      local orig_push = gcal.push
+      gcal.push = function()
         called = true
       end
-      pending.command('gcal sync')
-      gcal.sync = orig_sync
+      pending.command('gcal push')
+      gcal.push = orig_push
       assert.is_true(called)
     end)
 
@@ -90,10 +90,10 @@ describe('sync', function()
     config.reset()
     vim.g.pending = {
       data_path = tmpdir .. '/tasks.json',
-      sync = { gcal = { calendar = 'NewStyle' } },
+      sync = { gcal = { client_id = 'test-id' } },
     }
     local cfg = config.get()
-    assert.are.equal('NewStyle', cfg.sync.gcal.calendar)
+    assert.are.equal('test-id', cfg.sync.gcal.client_id)
   end)
 
   describe('gcal module', function()
@@ -107,9 +107,9 @@ describe('sync', function()
       assert.are.equal('function', type(gcal.auth))
     end)
 
-    it('has sync function', function()
+    it('has push function', function()
       local gcal = require('pending.sync.gcal')
-      assert.are.equal('function', type(gcal.sync))
+      assert.are.equal('function', type(gcal.push))
     end)
 
     it('has health function', function()