Store account credentials encrypted and bind QR tasks to administrator sessions. Report calendar access as awaiting validation after login.
Prevent late polls and status responses from overwriting cancelled or newer operations, and clean up QR tasks when settings unmount. Cover authentication, cancellation races, and stale frontend responses.
