feat: add calendar visibility picker

Derive session calendars from event metadata and apply one visibility contract to month rendering, appointment focus, and search without filtering persistence writes.

Add keyboard picker coverage, full-model save regression tests, documentation, warning-clean builds, sanitizer verification, and live PTY terminal restoration checks.

docs/ARCHITECTURE.md

@@ -40,6 +40,13 @@ owns result presentation and occurrence identity. Recurring searches expand a
 finite window of five years on either side of the selected date so an unbounded
 rule cannot turn an interactive query into unbounded work.
 
+Calendar visibility is session presentation state. The controller derives its
+calendar list from event calendar identifiers and applies the same domain
+predicate to month rendering, focus traversal, and search. Hidden events remain
+in the canonical collection passed to persistence, and focus identities are
+always derived from that complete collection so filtering cannot renumber
+events with duplicate or missing UIDs.
+
 Timed events retain their source basis: UTC, floating process-local time, or an
 IANA `TZID`. C++20 time-zone conversion keeps zoned recurrences at their civil
 wall time across daylight-saving transitions. The month grid displays instants