[pending-judge] feat(DC-161): calendar widget + Radicale auto-wiring

- Top-bar calendar widget (status/js/calendar-widget.js): next-appointment
  display, settings modal with CalDAV/ICS source management and a
  Test-connection probe. Follows the weather-widget pattern.
- Backend routes/calendar.js: sources CRUD (secrets in credential manager,
  never in responses), aggregated events across sources with per-source
  error isolation, Radicale provision endpoint, CalDAV discover probe.
- src/calendar/ics-parser.js: dependency-free RFC 5545 parser with bounded
  RRULE expansion (DAILY/WEEKLY-BYDAY/MONTHLY/YEARLY, COUNT/UNTIL/INTERVAL,
  EXDATE consumes COUNT, RECURRENCE-ID overrides), 500-event cap.
- src/calendar/caldav-client.js: CalDAV REPORT time-range queries over
  node:https (no new deps), HTTPS-enforced off localhost, 5MiB response cap.
- src/calendar/radicale-provisioner.js: zero-config auto-wiring - generates
  a 24-char password, writes Radicale htpasswd config (pure-Node APR1 hash
  verified byte-for-byte against openssl passwd -apr1 vectors), stores
  credentials, registers the source. Deploy hook in routes/apps/deploy.js
  wires any Radicale deployed via the App Selector automatically.
- Radicale app template (tomsquest/docker-radicale) in the catalog.
- Tests: 32 new (parser unit, provisioner unit incl. openssl vectors,
  route tests). Full suite 3552 passed; only pre-existing pdf-parse
  billing/invoice failures remain (proven red at base 448f535).
- OpenAPI: 5 calendar paths documented. CHANGELOG entry added.

CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to DashCaddy are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+- **DC-161: Calendar widget + Radicale auto-wiring.** New top-bar calendar widget
+  (`status/js/calendar-widget.js`) showing upcoming appointments; settings modal for
+  adding CalDAV / ICS-feed sources with a Test-connection probe. Backend:
+  `routes/calendar.js` (`GET/POST/PUT/DELETE /api/v1/calendar/sources`,
+  `GET /api/v1/calendar/events`, `POST /api/v1/calendar/radicale/provision`,
+  `POST /api/v1/calendar/discover`), dependency-free RFC 5545 ICS parser with
+  bounded RRULE expansion (`src/calendar/ics-parser.js`), CalDAV REPORT client
+  over node:https (`src/calendar/caldav-client.js`). When Radicale is deployed
+  through the App Selector, the deploy hook auto-provisions htpasswd credentials
+  (pure-Node APR1 hash, verified byte-for-byte against `openssl passwd -apr1`)
+  and registers the calendar source — the widget connects with zero user input.
+  Manual bring-your-own sources (Radicale/Baikal/Nextcloud hosted elsewhere,
+  iCloud/Fastmail CalDAV, plain ICS feeds) wire in through the settings modal.
+
 ## [1.17.0] - 2026-10-07
 
 ### Added