Fix flaky calendar e2e: count the test's own events, not the whole day
Security hardening: HSTS, forwarded-IP trust, single-use TOTP