[pending-judge] feat(DC-161): calendar widget + Radicale auto-wiring

- Top-bar calendar widget (status/js/calendar-widget.js): next-appointment
  display, settings modal with CalDAV/ICS source management and a
  Test-connection probe. Follows the weather-widget pattern.
- Backend routes/calendar.js: sources CRUD (secrets in credential manager,
  never in responses), aggregated events across sources with per-source
  error isolation, Radicale provision endpoint, CalDAV discover probe.
- src/calendar/ics-parser.js: dependency-free RFC 5545 parser with bounded
  RRULE expansion (DAILY/WEEKLY-BYDAY/MONTHLY/YEARLY, COUNT/UNTIL/INTERVAL,
  EXDATE consumes COUNT, RECURRENCE-ID overrides), 500-event cap.
- src/calendar/caldav-client.js: CalDAV REPORT time-range queries over
  node:https (no new deps), HTTPS-enforced off localhost, 5MiB response cap.
- src/calendar/radicale-provisioner.js: zero-config auto-wiring - generates
  a 24-char password, writes Radicale htpasswd config (pure-Node APR1 hash
  verified byte-for-byte against openssl passwd -apr1 vectors), stores
  credentials, registers the source. Deploy hook in routes/apps/deploy.js
  wires any Radicale deployed via the App Selector automatically.
- Radicale app template (tomsquest/docker-radicale) in the catalog.
- Tests: 32 new (parser unit, provisioner unit incl. openssl vectors,
  route tests). Full suite 3552 passed; only pre-existing pdf-parse
  billing/invoice failures remain (proven red at base 448f535).
- OpenAPI: 5 calendar paths documented. CHANGELOG entry added.

dashcaddy-api/src/docker/app-templates.js

@@ -251,6 +251,38 @@ const APP_TEMPLATES = {
   },
 
   // === PRODUCTIVITY & TOOLS ===
+
+  // DC-161: Radicale — lightweight CalDAV/CardDAV server. When deployed via
+  // DashCaddy the calendar widget auto-wires to it (see routes/calendar.js):
+  // the deploy hook provisions config+credentials and registers the source.
+  "radicale": {
+    name: "Radicale Calendar",
+    description: "Lightweight self-hosted calendar (CalDAV) and contacts (CardDAV) server. Auto-connects to the DashCaddy calendar widget.",
+    icon: "📅",
+    category: "Productivity",
+    popularity: 68,
+    difficulty: "Easy",
+    docker: {
+      image: "tomsquest/docker-radicale:latest",
+      ports: ["{{PORT}}:5232"],
+      volumes: [
+        "/opt/radicale/config:/config",
+        "/opt/radicale/data:/data"
+      ],
+      environment: {}
+    },
+    subdomain: "calendar",
+    defaultPort: 5232,
+    healthCheck: "/",
+    subpathSupport: 'none',
+    setupInstructions: [
+      "Calendar is auto-wired into the DashCaddy dashboard widget",
+      "Add the CalDAV URL to your phone/computer calendar apps: https://<domain>/<username>/",
+      "Manage sharing and additional users from the Radicale web interface"
+    ],
+    secrets: []
+  },
+
   "nextcloud": {
     name: "Nextcloud",
     description: "Self-hosted productivity platform and file sync",