feat(agent): add study task and deadline tools

[SebastianBoehler]

Summary

• add get_tasks and get_deadlines tools for ILIAS and Moodle
• port focused SAML/Shibboleth session, ILIAS task/assignment parsing, and Moodle calendar normalization contracts from tue-api-wrapper
• execute portal access in the app for both on-device and cloud model providers
• keep passwords, cookies, SAML fields, session keys, and raw portal HTML on-device; cloud providers receive only sanitized task/deadline results
• add bounded traversal, source timeouts, TTL/stale caching, partial-source failures, date windowing, deduplication, and explicit authentication-required results
• scope cookies per host, reject non-university redirects, and strip session-shaped query parameters from tool output
• recognize the current ILIAS authenticated shell after SAML and preserve bounded handoff-stage diagnostics instead of collapsing them to a generic expired-session error
• handle the IdP's current button-based proceed/consent forms while submitting only the selected required action
• include bounded per-source failure reasons in partial results so ILIAS handoff failures are not hidden behind a generic message

Validation

• dart format --output=none --set-exit-if-changed lib test
• flutter analyze
• flutter test (133 tests)
• focused cloud/private-tool and provider-wiring tests (17 tests)
• flutter build web --release
• git diff --check

Privacy boundary

The app performs authenticated portal requests locally. When the selected provider is a cloud model, the sanitized tool result (task titles, course labels, dates, statuses, and safe portal targets) is returned to that provider so it can answer. Credentials and session material are never serialized into the model request. The README documents that students should select the on-device model when task/deadline results must remain on-device too.

Stack

This PR is intentionally based on #65 because it reuses that PR's capability result/policy foundation. Retarget it to main after #65 lands.

Part of #60.