docs: describe the cycle calendar subscription

A how-to for subscribing from Google, Apple and Outlook and what the
feed shows; a section on the reproductive-health page saying that once
it is on, the dates also sit with the calendar provider and turning it
off does not reach those copies; a reverse-proxy note with Caddy and
Nginx examples for keeping path credentials out of access logs; and
API_TOKEN_HMAC_KEY rotation named as ending every feed link.

docs/using/cycle-calendar-feed.md

@@ -0,0 +1,53 @@
+# Subscribing to your cycle forecast
+
+HealthLog can publish your cycle forecast as a calendar subscription, so the
+next few periods show up in the calendar app you already use. The feed is
+computed fresh every time your calendar app asks for it; HealthLog stays the
+only place the data is kept.
+
+## Turning it on
+
+Open **Cycle**, then **Settings**, and find **Calendar subscription**. Before
+the button, the card says what it means: your calendar provider stores the
+dates on its servers, and turning the subscription off later does not remove
+copies it already holds. HealthLog asks you to confirm it is you (a password or
+passkey) and then shows the link once. Copy it, or use **Open in calendar app**.
+
+Only the record's owner, or someone who manages it with a MANAGE grant that
+covers cycle data, can turn it on. It is managed on the web; the iOS app shows
+where to find it.
+
+## Adding it to your calendar
+
+- **Google Calendar:** Other calendars, From URL, paste the link. Google
+  refreshes subscriptions on its own schedule, roughly every 12 to 24 hours.
+- **Apple Calendar:** on a Mac, File, New Calendar Subscription. On iPhone,
+  Settings, Calendar, Accounts, Add Account, Other, Add Subscribed Calendar.
+  Apple lets you choose how often it refreshes.
+- **Outlook:** Add calendar, Subscribe from web, paste the link. Outlook
+  refreshes every few hours.
+
+## What the feed shows
+
+- The next period and, once three cycles are logged, a few after it (three
+  by default, up to six). Each event covers the whole window the period may
+  fall in, and the window widens the further out it is. The list stops itself
+  where a date would be more guess than estimate (beyond about ±10 days, or
+  half a cycle).
+- Optionally, your past cycles (up to twelve).
+- Optionally, when your goal is trying to conceive, the estimated fertile
+  window of the next cycle. It is an estimate, not a contraceptive method.
+
+Titles are discreet by default: each event is a dot and the calendar is called
+"HealthLog". Descriptive titles name the period instead. Events never carry
+symptoms, notes or any other detail of your log.
+
+When a period is later than its window, the feed shows no forecast until you
+log it, instead of guessing a new date. With predictions switched off, only
+past cycles appear (if you chose to include them).
+
+## Rotating and turning off
+
+**Rotate link** replaces the link; calendars using the old one stop updating.
+**Turn off** ends the link. In both cases, remove the old subscribed calendar
+in your calendar app too: what it already fetched stays there until you do.