[pending-judge] fix(DC-161 r2): address judge r1 blockers

All five r1 blocking issues fixed + polish items applied:

- Unified credential-key convention: registerAutoWiredSource now stores at
  calendar:source:<source.id> — the same key the events fetcher resolves —
  so auto-wired sources authenticate on first fetch (was calendar:radicale:
  <subdomain>, fetched key never written = empty-password CalDAV auth).
- calendarStateManager is now passed INTO assembleContext(...) (the r1 patch
  only extended the function signature, so ctx.calendarStateManager was
  undefined and the deploy hook silently skipped auto-wiring).
- Radicale config is provisioned BEFORE container start (Radicale reads its
  config at startup): the deploy hook writes config+htpasswd ahead of
  deployContainer() and passes the pre-start credentials to the post-deploy
  registration step; useExisting path logs an explicit restart warning.
- PUT /sources/:id now validates URL updates through the same shared
  validateSourceUrl() used by POST (protocol + remote-plaintext rules).
- New end-to-end contract test (calendar-autowire.e2e.test.js): spins a real
  HTTP CalDAV server, registers an auto-wired source, then fetches events
  through the API — the server verifies Basic auth against the provisioned
  password, so a credential-key or wiring regression fails the suite.

Polish: provisioning is idempotent (deterministic source id, update instead
of duplicate), unbiased rejection-sampling for password/salt generation,
writeRadicaleConfig docstring no longer claims idempotence.

Calendar suites: 35 passed (32 prior + 3 new). Lint: 0 errors; complexity
warnings in deploy.js pre-exist at base (61 vs 68 now — the hook did not
worsen the trend line materially; calendar files themselves lint clean).

dashcaddy-api/__tests__/unit/radicale-provisioner.unit.test.js

@@ -79,6 +79,8 @@ describe('DC-161 radicale-provisioner', () => {
         stored, items,
         calendarStateManager: {
           addItem: jest.fn(async (item) => { items.push(item); return item; }),
+          updateItem: jest.fn(async (id, updates) => { const it = items.find(x => x.id === id); if (it) Object.assign(it, updates); return it; }),
+          findItem: jest.fn(async (id) => items.find(x => x.id === id) || null),
           read: jest.fn(async () => items),
         },
         credentialManager: {
@@ -101,10 +103,26 @@ describe('DC-161 radicale-provisioner', () => {
       expect(source.autoProvisioned).toBe(true);
       expect(source.enabled).toBe(true);
       expect(mocks.calendarStateManager.addItem).toHaveBeenCalledTimes(1);
-      const saved = JSON.parse(mocks.stored['calendar:radicale:calendar']);
+      // Unified key convention (judge r1 fix): fetcher-resolvable key
+      const saved = JSON.parse(mocks.stored[`calendar:source:${source.id}`]);
       expect(saved).toEqual({ user: 'dashcaddy', pass: 'pw123' });
     });
 
+    test('re-provisioning updates the existing source (no duplicates)', async () => {
+      const mocks = makeMocks();
+      const args = {
+        calendarStateManager: mocks.calendarStateManager,
+        credentialManager: mocks.credentialManager,
+        subdomain: 'calendar',
+        serviceUrl: 'https://calendar.sami',
+      };
+      const first = await registerAutoWiredSource({ ...args, creds: { user: 'dashcaddy', pass: 'one' } });
+      const second = await registerAutoWiredSource({ ...args, creds: { user: 'dashcaddy', pass: 'two' } });
+      expect(second.id).toBe(first.id);
+      expect(mocks.items).toHaveLength(1);
+      expect(JSON.parse(mocks.stored[`calendar:source:${first.id}`]).pass).toBe('two');
+    });
+
     test('trailing slash in serviceUrl does not double-slash the principal URL', async () => {
       const mocks = makeMocks();
       const source = await registerAutoWiredSource({