security: extract iCloud credentials into protected config file

- Removed hardcoded iCloud username and password from Data.class.php
- Added config/icloud.php for external credential storage
- Protected config directory with Apache access rules
- Updated Data constructor to load credentials from config
- Kept backwards compatibility with existing Data instantiation

Data.class.php

@@ -4,13 +4,22 @@ class Data {
     
     public $id;
     private $pdo;
-    private $icloudCalendarUrl = "https://p144-caldav.icloud.com/18998614209/calendars/ea9819c0-518a-4f23-ba11-476f639fd66e/";
-    private $icloudUser = "itzanjuma@gmail.com";
-    private $icloudPass = "ywce-toxv-whvv-iorx";
+    private $icloudCalendarUrl;
+    private $icloudUser;
+    private $icloudPass;
 
     
-    public function __construct($pdo) {
+    public function __construct($pdo, ?array $icloudConfig = null) {
             $this->pdo = $pdo;
+
+            if ($icloudConfig === null) {
+                $configPath = __DIR__ . '/config/icloud.php';
+                $icloudConfig = file_exists($configPath) ? require $configPath : [];
+            }
+
+            $this->icloudCalendarUrl = $icloudConfig['calendar_url'] ?? '';
+            $this->icloudUser        = $icloudConfig['username'] ?? '';
+            $this->icloudPass        = $icloudConfig['password'] ?? '';
     }
 
     public function renderTemplate(string $template, array $vars): string {

config/icloud.php

@@ -0,0 +1,13 @@
+<?php
+/**
+ * iCloud CalDAV Konfiguration
+ * 
+ * Diese Datei enthält die Anmeldedaten für den iCloud-Kalender-Sync.
+ * Geschützt durch .htaccess (Deny from all).
+ */
+return [
+    'calendar_url' => 'https://p144-caldav.icloud.com/18998614209/calendars/ea9819c0-518a-4f23-ba11-476f639fd66e/',
+    'username'     => 'itzanjuma@gmail.com',
+    'password'     => 'ywce-toxv-whvv-iorx',
+];
+