fix(plugins): JSON-serialize CallFunctionJSON return values + backward compat Lua args

Root cause: CallFunctionJSON used .String() on Lua return values, which
for tables produces 'table: 0x...' — not valid JSON. Frontend does
JSON.parse() on the result and silently caught the parse error.

Fix:
- runtime.go: convert Lua return value to JSON via luaValueToGo +
  json.Marshal so tables become proper JSON arrays/objects
- main.lua: add backward compat in get_events() and update_event()
  to accept both positional args (start, end) and table params
- CalendarPluginPage.svelte: show errors in UI instead of silent catch;
  restructure template to always show iframe + error overlay

internal/core/plugins/runtime.go

@@ -255,7 +255,15 @@ func (vm *LuaVM) CallFunctionJSON(segments []string, paramsJSON string) (string,
 	if err != nil {
 		return "", err
 	}
-	return ret.String(), nil
+	// Convert Lua return value to JSON for the frontend.
+	// Lua tables (from db.query, etc.) return "table: 0x..." via .String() —
+	// the frontend always expects valid JSON for JSON.parse().
+	goVal := luaValueToGo(ret)
+	jsonBytes, marshalErr := json.Marshal(goVal)
+	if marshalErr != nil {
+		return "", fmt.Errorf("failed to marshal return value: %w", marshalErr)
+	}
+	return string(jsonBytes), nil
 }
 
 // LState returns the underlying lua.LState (for table creation outside CallFunctionJSON).

internal/core/plugins/security_test.go

@@ -1569,8 +1569,8 @@ end
 	if err != nil {
 		t.Fatalf("CallFunctionJSON: %v", err)
 	}
-	if result != "hello:42" {
-		t.Errorf("echo_json = %q, want %q", result, "hello:42")
+	if result != `"hello:42"` {
+		t.Errorf("echo_json = %q, want %q", result, `"hello:42"`)
 	}
 
 	// Test with JSON array