feat: add Google Calendar timetable sync via accounts OAuth

OAuth flows through accounts.betterseqta.org with token exchange server-side. Sync runs in the content script to avoid MV3 service worker timeouts. Adds Svelte calendar sync UI on the timetable page, extension asset URL helper, and excludes calendar tokens from cloud sync.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/manifests/manifest.json

@@ -15,17 +15,25 @@
       "64": "resources/icons/icon-64.png"
     }
   },
-  "permissions": ["tabs", "notifications", "storage"],
-  "host_permissions": ["https://newsapi.org/", "https://betterseqta.org/", "https://accounts.betterseqta.org/", "*://*/*"],
+  "permissions": ["tabs", "notifications", "storage", "identity"],
+  "host_permissions": [
+    "https://newsapi.org/",
+    "https://betterseqta.org/",
+    "https://accounts.betterseqta.org/",
+    "https://www.googleapis.com/",
+    "https://oauth2.googleapis.com/",
+    "*://*/*"
+  ],
   "background": {
     "service_worker": "background.ts"
   },
   "content_security_policy": {
-    "extension_pages": "script-src 'self'; object-src 'self'; connect-src 'self' http: https: https://betterseqta.org https://accounts.betterseqta.org https://raw.githubusercontent.com https://newsapi.org"
+    "extension_pages": "script-src 'self'; object-src 'self'; connect-src 'self' http: https: https://betterseqta.org https://accounts.betterseqta.org https://raw.githubusercontent.com https://newsapi.org https://www.googleapis.com https://oauth2.googleapis.com"
   },
   "content_scripts": [
     {
       "matches": ["*://*/*"],
+      "exclude_matches": ["*://accounts.betterseqta.org/*"],
       "js": ["SEQTA.ts"],
       "run_at": "document_start"
     }
@@ -36,7 +44,8 @@
         "resources/icons/*",
         "resources/update-image.webp",
         "resources/pdfjs/pdf.worker.min.mjs",
-        "resources/pdfjs/pdf.legacy.min.mjs"
+        "resources/pdfjs/pdf.legacy.min.mjs",
+        "assets/*"
       ],
       "matches": ["*://*/*"]
     }