[pending-judge] feat(DC-161): calendar widget + Radicale auto-wiring

- Top-bar calendar widget (status/js/calendar-widget.js): next-appointment
  display, settings modal with CalDAV/ICS source management and a
  Test-connection probe. Follows the weather-widget pattern.
- Backend routes/calendar.js: sources CRUD (secrets in credential manager,
  never in responses), aggregated events across sources with per-source
  error isolation, Radicale provision endpoint, CalDAV discover probe.
- src/calendar/ics-parser.js: dependency-free RFC 5545 parser with bounded
  RRULE expansion (DAILY/WEEKLY-BYDAY/MONTHLY/YEARLY, COUNT/UNTIL/INTERVAL,
  EXDATE consumes COUNT, RECURRENCE-ID overrides), 500-event cap.
- src/calendar/caldav-client.js: CalDAV REPORT time-range queries over
  node:https (no new deps), HTTPS-enforced off localhost, 5MiB response cap.
- src/calendar/radicale-provisioner.js: zero-config auto-wiring - generates
  a 24-char password, writes Radicale htpasswd config (pure-Node APR1 hash
  verified byte-for-byte against openssl passwd -apr1 vectors), stores
  credentials, registers the source. Deploy hook in routes/apps/deploy.js
  wires any Radicale deployed via the App Selector automatically.
- Radicale app template (tomsquest/docker-radicale) in the catalog.
- Tests: 32 new (parser unit, provisioner unit incl. openssl vectors,
  route tests). Full suite 3552 passed; only pre-existing pdf-parse
  billing/invoice failures remain (proven red at base 448f535).
- OpenAPI: 5 calendar paths documented. CHANGELOG entry added.

dashcaddy-api/routes/apps/deploy.js

@@ -408,6 +408,29 @@ module.exports = function({ docker, caddy, credentialManager, servicesStateManag
       });
       log.info('deploy', 'Service added to dashboard', { subdomain: config.subdomain });
 
+      // DC-161: calendar apps auto-wire the dashboard calendar widget.
+      // Zero user input — credentials + source registered server-side.
+      if (appId === 'radicale' && ctx.calendarStateManager) {
+        try {
+          const { generatePassword, writeRadicaleConfig, registerAutoWiredSource } = require('../../src/calendar/radicale-provisioner');
+          const calUser = 'dashcaddy';
+          const calPass = generatePassword();
+          await writeRadicaleConfig('/opt/radicale/config', { user: calUser, pass: calPass });
+          await registerAutoWiredSource({
+            calendarStateManager: ctx.calendarStateManager,
+            credentialManager,
+            subdomain: config.subdomain,
+            serviceUrl,
+            creds: { user: calUser, pass: calPass },
+            templateId: 'radicale',
+          });
+          log.info('deploy', 'Calendar widget auto-wired to Radicale', { subdomain: config.subdomain });
+        } catch (calError) {
+          // Non-fatal: the app is deployed; wiring can be redone via POST /api/v1/calendar/radicale/provision
+          log.warn('deploy', 'Calendar auto-wiring failed (non-fatal)', { error: calError.message });
+        }
+      }
+
       const response = {
         success: true, containerId, usedExisting,
         url: serviceUrl,