refactor: rename package fabledassistant -> scribe (code-only)

Renames src/fabledassistant -> src/scribe and all imports, plus the
default DB name and DB user/password (fabled -> scribe) in config +
compose. 952 refs / 154 files. Reverses the old 'internal name stays
fabledassistant' convention.

Code-only: live databases are still physically named 'fabledassistant'.
Deployed environments must set POSTGRES_DB / POSTGRES_USER (or rename the
DB) since the defaults now resolve to 'scribe'. Repo (FabledScribe), git
host (fabledsword), MCP (fabled-git) and the image name (fabledscribe)
are intentionally unchanged.

ruff check src/ clean locally; CI (typecheck + pytest) is the gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/scribe/routes/settings.py

@@ -0,0 +1,131 @@
+"""User settings + integrations (CalDAV, SearXNG status).
+
+Chat-model picker endpoints (/models), KV-cache priming, and journal-schedule
+hooks were removed in Phase 8 alongside the chat/journal subsystems.
+"""
+import ipaddress
+import logging
+import socket
+from urllib.parse import urlparse
+
+from quart import Blueprint, jsonify, request
+
+from scribe.auth import login_required, get_current_user_id
+from scribe.config import Config
+from scribe.services.caldav import CALDAV_SETTING_KEYS, get_caldav_config, test_connection
+from scribe.services.settings import delete_setting, get_all_settings, get_setting, set_settings_batch
+
+logger = logging.getLogger(__name__)
+
+
+def _is_private_url(url: str) -> bool:
+    """SSRF-blocking helper: returns True for URLs that resolve to private,
+    loopback, or link-local addresses. Inlined here after services/llm.py
+    (the original home) was removed in Phase 8."""
+    try:
+        host = urlparse(url).hostname
+        if not host:
+            return True
+        # Resolve to all addresses; reject if any is private/loopback/link-local.
+        infos = socket.getaddrinfo(host, None)
+        for family, *_rest, sockaddr in infos:
+            ip_str = sockaddr[0]
+            try:
+                ip = ipaddress.ip_address(ip_str)
+            except ValueError:
+                continue
+            if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
+                return True
+    except Exception:
+        # Conservative: if we can't resolve, treat as private (reject).
+        return True
+    return False
+
+
+settings_bp = Blueprint("settings", __name__, url_prefix="/api/settings")
+
+
+@settings_bp.route("", methods=["GET"])
+@login_required
+async def get_settings_route():
+    uid = get_current_user_id()
+    settings = await get_all_settings(uid)
+    return jsonify(settings)
+
+
+@settings_bp.route("", methods=["PUT"])
+@login_required
+async def update_settings_route():
+    uid = get_current_user_id()
+    data = await request.get_json()
+    if not isinstance(data, dict):
+        return jsonify({"error": "Expected a JSON object"}), 400
+
+    to_save = {}
+    for k, v in data.items():
+        str_v = str(v)
+        if not str_v:
+            await delete_setting(uid, k)
+        else:
+            to_save[k] = str_v
+
+    if to_save:
+        await set_settings_batch(uid, to_save)
+
+    settings = await get_all_settings(uid)
+    return jsonify(settings)
+
+
+@settings_bp.route("/caldav", methods=["GET"])
+@login_required
+async def get_caldav():
+    uid = get_current_user_id()
+    config = await get_caldav_config(uid)
+    if config.get("caldav_password"):
+        config["caldav_password"] = "********"
+    return jsonify(config)
+
+
+@settings_bp.route("/caldav", methods=["PUT"])
+@login_required
+async def update_caldav():
+    uid = get_current_user_id()
+    data = await request.get_json()
+
+    # Validate CalDAV URL before saving — block internal/private addresses
+    if "caldav_url" in data:
+        url = str(data.get("caldav_url") or "").strip()
+        if url:
+            parsed_scheme = url.split("://")[0].lower() if "://" in url else ""
+            if parsed_scheme not in ("http", "https"):
+                return jsonify({"error": "CalDAV URL must use http or https"}), 400
+            if _is_private_url(url):
+                return jsonify({"error": "CalDAV URL must not point to an internal or private address"}), 400
+
+    settings_to_save = {}
+    for key in CALDAV_SETTING_KEYS:
+        if key in data:
+            if key == "caldav_password" and data[key] == "********":
+                continue
+            settings_to_save[key] = str(data[key])
+
+    if settings_to_save:
+        await set_settings_batch(uid, settings_to_save)
+    return jsonify({"status": "ok"})
+
+
+@settings_bp.route("/caldav/test", methods=["POST"])
+@login_required
+async def test_caldav():
+    uid = get_current_user_id()
+    result = await test_connection(uid)
+    return jsonify(result)
+
+
+@settings_bp.route("/search", methods=["GET"])
+@login_required
+async def test_search():
+    """Report SearXNG configuration status (used by the Integrations tab)."""
+    if not Config.searxng_enabled():
+        return jsonify({"configured": False, "results": [], "searxng_url": ""})
+    return jsonify({"configured": True, "results": [], "searxng_url": Config.SEARXNG_URL})