Fix Google Calendar integration

[blackbartblues]

What changed

• add a native Google Calendar transport backed by a read-only, Calendar-only authorized-user token
• support list, create, update, and delete without relying on unsupported Hermes CLI commands
• keep the legacy GOOGLE_CALENDAR_COMMAND transport for existing installations
• hard-confine every operation to GOOGLE_CALENDAR_HOME_ID
• reload a replaced OAuth token after reauthorization and map auth failures to the existing safe reauth state
• validate incomplete or unreadable Calendar configuration during strict startup
• document the private Compose mount and least-privilege setup

Why

The existing adapter called calendar update, but the current Hermes google_api.py contract implements list, create, and delete only. The production Dante container also had no complete deployment path for running that external client. This made updates fail and left the integration difficult to configure reliably.

Impact

Operators can mount a Calendar-only token read-only and get the complete calendar contract. Existing command-based configurations continue to work for their supported operations.

Validation

• PYTHONPATH=server python -m pytest server/tests -q — 376 passed
• OpenAPI contract check
• public-readiness self-test
• git diff --check
• production server Docker image build