Integrate the groupware calendar

Use authenticated, tenant-bound REST resources below /api/v1/calendar/ and CalDAV discovery at /.well-known/caldav. Workspace does not expose an anonymous slot-booking API.

Calendar feeds expose bounded occurrence queries of at most 366 days. Resources live below /api/v1/calendar/resources, delegations below /api/v1/self/calendar/feeds/delegations, and external connections below /api/v1/calendar/sync-connections. Resolve sync conflicts explicitly with a local or remote decision.

Authenticated users list appointments organized by another member at /api/v1/self/calendar/invitations. Access is authorized by the tenant-local identity participant record. Responses include the current event sequence and stale responses are rejected. External response tokens are revoked after the first successful response, and the email links to the HTML representation of the same public endpoint.

Preview a single-event ICS payload at /api/v1/self/calendar/feeds/{feedId}/import/preview, then submit the same {"ics":"..."} body to .../import/apply. Preview is stateless and performs no write; apply parses the payload again and creates exactly one event.

CalDAV supports stable UIDs, ETags, calendar query, multiget, incremental sync tokens, tombstones, recurrence, participants, and alarms. Domain projections are separate read-only collections. Always handle machine-readable errors and never surface raw upstream or database details.