[pending-judge] feat(DC-161): calendar widget + Radicale auto-wiring

- Top-bar calendar widget (status/js/calendar-widget.js): next-appointment
  display, settings modal with CalDAV/ICS source management and a
  Test-connection probe. Follows the weather-widget pattern.
- Backend routes/calendar.js: sources CRUD (secrets in credential manager,
  never in responses), aggregated events across sources with per-source
  error isolation, Radicale provision endpoint, CalDAV discover probe.
- src/calendar/ics-parser.js: dependency-free RFC 5545 parser with bounded
  RRULE expansion (DAILY/WEEKLY-BYDAY/MONTHLY/YEARLY, COUNT/UNTIL/INTERVAL,
  EXDATE consumes COUNT, RECURRENCE-ID overrides), 500-event cap.
- src/calendar/caldav-client.js: CalDAV REPORT time-range queries over
  node:https (no new deps), HTTPS-enforced off localhost, 5MiB response cap.
- src/calendar/radicale-provisioner.js: zero-config auto-wiring - generates
  a 24-char password, writes Radicale htpasswd config (pure-Node APR1 hash
  verified byte-for-byte against openssl passwd -apr1 vectors), stores
  credentials, registers the source. Deploy hook in routes/apps/deploy.js
  wires any Radicale deployed via the App Selector automatically.
- Radicale app template (tomsquest/docker-radicale) in the catalog.
- Tests: 32 new (parser unit, provisioner unit incl. openssl vectors,
  route tests). Full suite 3552 passed; only pre-existing pdf-parse
  billing/invoice failures remain (proven red at base 448f535).
- OpenAPI: 5 calendar paths documented. CHANGELOG entry added.

status/css/dashboard.css

@@ -4200,3 +4200,50 @@ button:focus-visible {
     font-size: clamp(1rem, 6vw, 1.4rem);
   }
 }
+
+/* ===== Calendar Widget (DC-161) — mirrors weather-widget placement ===== */
+.calendar-widget-container {
+  display: flex;
+  align-items: center;
+  margin-bottom: 0;
+  flex-shrink: 1;
+}
+
+.calendar-widget {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 4px 10px;
+  border: 1px solid var(--border);
+  border-radius: 999px;
+  background: transparent;
+  cursor: pointer;
+  min-width: 0;
+  font-size: 0.85rem;
+  color: var(--fg);
+  transition: background 0.2s ease, border-color 0.2s ease;
+}
+
+.calendar-widget:hover,
+.calendar-widget:focus-visible {
+  background: color-mix(in srgb, var(--accent) 10%, transparent);
+  border-color: var(--accent);
+  outline: none;
+}
+
+.calendar-widget-icon {
+  font-size: 1.05rem;
+  line-height: 1;
+}
+
+.calendar-widget-text {
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  max-width: 220px;
+}
+
+/* Top-row position variants — calendar sits after the clock widget */
+.top-row[data-logo-pos="left"] .calendar-widget-container { order: 3; }
+.top-row[data-logo-pos="center"] .calendar-widget-container { order: 3; }
+.top-row[data-logo-pos="right"] .calendar-widget-container { order: 3; margin-top: -80px; }