Changelog

Events from external sources (CalDAV subscriptions, ICS feeds) are

marked local_only in the database and should never be synced to cloud

or P2P — the remote server is the source of truth.

Two defense-in-depth guards added:

1. SdkHost.NotifySyncIfMutation: Skip sync notification entirely when

the SDK request carries the local_only parameter. This prevents

the outbound pipeline from ever seeing local_only mutations.

2. SyncOutboundService.NotifyEntityChanged: Parse the entity payload

JSON and reject entities where local_only is true. Catches any

edge case where a local_only entity reaches the outbound path

without the parameter (e.g. ViewModel-initiated edits).

Replace hardcoded Tasks/Projects endpoint sections with an ItemsControl

that discovers all IApiProvider plugins at runtime via IPluginRegistry.

Each plugin gets a collapsible Expander showing its routes with color-coded

HTTP methods (GET=green, POST=primary, PATCH=warning, DELETE=danger).

• LoadRoutes() resolves plugin display names from metadata
• MethodBrush resolved from theme resources at load time
• Empty state shown when no plugins register API endpoints
• Shell endpoints (status, routes) remain static

New ApiDocsWindow dialog accessible from Settings > Developer via

"View Documentation" link. Shows a comprehensive guide with:

• Overview of the local API and its purpose
• Authentication instructions (X-API-Key and Bearer token)
• Step-by-step getting started guide with curl examples
• Full endpoint listing (shell, tasks, projects) with color-coded

HTTP methods (GET/POST/PATCH/DELETE)

• Create and search task examples with complete curl commands
• Security note about localhost-only binding and key management

New "Developer" category in Settings (between Security and Enterprise)

with UI to enable/disable the local HTTP API server:

• Enable toggle that starts/stops the Kestrel server immediately
• Port configuration field (default 9720)
• API key display with Copy and Regenerate buttons
• Status indicator showing running state
• Quick test curl command for easy verification

Add IApiProvider to the capability table and describe the local API server

in the shell features section (port, auth, endpoints, opt-in setting).