[pending-judge] fix(DC-161 r2): address judge r1 blockers

All five r1 blocking issues fixed + polish items applied:

- Unified credential-key convention: registerAutoWiredSource now stores at
  calendar:source:<source.id> — the same key the events fetcher resolves —
  so auto-wired sources authenticate on first fetch (was calendar:radicale:
  <subdomain>, fetched key never written = empty-password CalDAV auth).
- calendarStateManager is now passed INTO assembleContext(...) (the r1 patch
  only extended the function signature, so ctx.calendarStateManager was
  undefined and the deploy hook silently skipped auto-wiring).
- Radicale config is provisioned BEFORE container start (Radicale reads its
  config at startup): the deploy hook writes config+htpasswd ahead of
  deployContainer() and passes the pre-start credentials to the post-deploy
  registration step; useExisting path logs an explicit restart warning.
- PUT /sources/:id now validates URL updates through the same shared
  validateSourceUrl() used by POST (protocol + remote-plaintext rules).
- New end-to-end contract test (calendar-autowire.e2e.test.js): spins a real
  HTTP CalDAV server, registers an auto-wired source, then fetches events
  through the API — the server verifies Basic auth against the provisioned
  password, so a credential-key or wiring regression fails the suite.

Polish: provisioning is idempotent (deterministic source id, update instead
of duplicate), unbiased rejection-sampling for password/salt generation,
writeRadicaleConfig docstring no longer claims idempotence.

Calendar suites: 35 passed (32 prior + 3 new). Lint: 0 errors; complexity
warnings in deploy.js pre-exist at base (61 vs 68 now — the hook did not
worsen the trend line materially; calendar files themselves lint clean).

dashcaddy-api/src/app.js

@@ -161,7 +161,9 @@ async function createApp() {
   // Create state managers
   const servicesStateManager = new StateManager(config.SERVICES_FILE);
   const configStateManager = new StateManager(config.CONFIG_FILE);
-  // DC-161: calendar sources live next to services.json (same dataDir guarantees)
+  // DC-161: calendar sources live next to services.json (same dataDir guarantees).
+  // Passed into assembleContext so the apps deploy hook (ctx.calendarStateManager)
+  // can auto-wire the widget when a calendar app is deployed.
   const calendarStateManager = new StateManager(
     require('path').join(require('path').dirname(config.SERVICES_FILE), 'calendar-sources.json')
   );
@@ -399,6 +401,7 @@ async function createApp() {
     // State managers
     servicesStateManager,
     configStateManager,
+    calendarStateManager,
 
     // DC-053: share store + signing secret
     shareStore,

dashcaddy-api/src/calendar/radicale-provisioner.js

@@ -42,11 +42,19 @@ type = internal
 `;
 
 function generatePassword() {
-  // 24 chars from a 62-char alphabet ≈ 142 bits — beyond brute-force reach
+  // 24 chars from a 62-char alphabet ≈ 142 bits. Unbiased: rejection-sample
+  // bytes above the last full multiple of the alphabet size (judge r1 polish).
   const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
-  const bytes = crypto.randomBytes(24);
+  const limit = Math.floor(256 / alphabet.length) * alphabet.length;
   let out = '';
-  for (const b of bytes) out += alphabet[b % alphabet.length];
+  while (out.length < 24) {
+    const bytes = crypto.randomBytes(32);
+    for (const b of bytes) {
+      if (b >= limit) continue; // reject biased tail
+      out += alphabet[b % alphabet.length];
+      if (out.length === 24) break;
+    }
+  }
   return out;
 }
 
@@ -113,9 +121,10 @@ function toBase64Apr1(digest) {
 }
 
 /**
- * Write (idempotently) the Radicale config + htpasswd into the host-side
- * config volume directory. Called before container start; if the files
- * already exist with the same content, nothing is written.
+ * Write the Radicale config + htpasswd into the host-side config volume
+ * directory. Called BEFORE container start (Radicale reads config at start).
+ * The write is unconditional but content-stable: same inputs produce the
+ * same files, so re-running provisioning converges to the same state.
  * @param {string} configDir host path bound to /config inside the container
  * @param {{user: string, pass: string}} creds
  * @returns {Promise<{written: boolean, configDir: string}>}
@@ -137,16 +146,18 @@ async function writeRadicaleConfig(configDir, { user, pass }) {
 /**
  * After a successful Radicale deploy: register the calendar source so the
  * widget auto-discovers it, and persist credentials.
+ *
+ * Credential-key convention (DC-161 r2 fix): ALL source credentials — manual
+ * and auto-wired — live at `calendar:source:<source.id>`. That is the key the
+ * events fetcher resolves, so auto-wired sources authenticate on first fetch.
+ * Idempotent: re-provisioning the same subdomain updates the existing source
+ * (deterministic id `auto-<templateId>-<subdomain>`) instead of duplicating.
+ *
  * @param {Object} deps
  * @returns {Promise<{source: Object}>}
  */
 async function registerAutoWiredSource({ calendarStateManager, credentialManager, subdomain, serviceUrl, creds, templateId = 'radicale' }) {
   const username = creds.user;
-  const credKey = `calendar:${templateId}:${subdomain}`;
-  await credentialManager.store(credKey, JSON.stringify({ user: username, pass: creds.pass }), {
-    label: `Calendar (${templateId}) — ${subdomain}`, auto: true, createdAt: new Date().toISOString(),
-  });
-
   const source = {
     id: `auto-${templateId}-${subdomain}`,
     type: 'caldav',
@@ -159,7 +170,18 @@ async function registerAutoWiredSource({ calendarStateManager, credentialManager
     enabled: true,
     createdAt: new Date().toISOString(),
   };
-  await calendarStateManager.addItem(source);
+
+  const credKey = `calendar:source:${source.id}`;
+  await credentialManager.store(credKey, JSON.stringify({ user: username, pass: creds.pass }), {
+    label: `Calendar (${templateId}) — ${subdomain}`, auto: true, createdAt: source.createdAt,
+  });
+
+  const existing = await calendarStateManager.findItem(source.id);
+  if (existing) {
+    await calendarStateManager.updateItem(source.id, source);
+  } else {
+    await calendarStateManager.addItem(source);
+  }
   return source;
 }