In Settings (upper right button) in the Personal (upper) section click Security
Or navigate your browser to: yourcloudurl/index.php/settings/user/security
It contains a (pobably) long list of client connections.
Scroll down to the bottom.
Set a name (e.g." Thunderbird Lightning") and Click Add app password
Copy the auto generated password for your current user.
In Thunderbird/Lightning, when it prompts you to enter the password for CalDav, paste the app password.
check the save password box so you don’t have to note it down.
I also felt pretty lost about this. Especially because Lightning happened to be able to connect the calendars once somewhere in the very beginning. So I expected a more sophisticated problem.