[pending-judge] fix(DC-161 r4): address judge r3 blockers

All three r3 blocking issues fixed + polish applied:

- Radicale provision route now FAILS CLOSED (409) unless the target container
  is present, inspectable, and its image matches /radicale/i. Missing
  containerId, failed inspect, or non-Radicale image → nothing is written to
  the shared config and no source/credential is registered. 4 new tests cover
  the three refusal paths + the verified-image happy path.
- ICS feed fetch now streams with a hard 5 MiB body cap (same bound as the
  CalDAV path) via readBodyCapped(); oversized feeds reject mid-stream and
  degrade to per-source error. Test covers a >5 MiB feed end-to-end.
- Verifier mode separation: `--verify` runs the same checks fully read-only
  (all output under mktemp -d in /tmp, transcript printed to stdout, scratch
  removed on exit — proven rc=0 with zero repo/tmp-side writes); default
  transcript mode is explicitly declared a TRANSCRIPT GENERATOR in its header
  and writes only under the script's own directory.
- Full-suite count assertions replaced with the documented invariant
  (failed ∈ [5,7], failing set == known-flaky billing suite, extras pass
  isolated rerun) — judge r3 polish.
- Stale credential-key comment in radicale-provisioner.js header corrected.

Calendar suites: 43 passed (38 + 5 new). Perf note: readBodyCapped streams;
no full-buffer read of unbounded bodies on the ICS path anymore.

dashcaddy-api/__tests__/routes/calendar.routes.test.js

@@ -144,6 +144,32 @@ describe('DC-161 calendar routes', () => {
   });
 
   describe('events aggregation', () => {
+    test('oversized ICS feed is rejected (5 MiB cap), source degrades to error', async () => {
+      await withServer(async (port, deps) => {
+        deps._items.push({ id: 'huge', type: 'ics', name: 'Huge', url: 'https://huge.example.com/c.ics', enabled: true });
+        // buildApPayload: a body just over 5 MiB
+        const bigIcs = 'BEGIN:VCALENDAR\r\nVERSION:2.0\r\n' + 'X'.repeat(5 * 1024 * 1024 + 10) + '\r\nEND:VCALENDAR';
+        deps.fetchT.mockImplementation(async () => ({
+          ok: true, status: 200,
+          body: { getReader: () => {
+            const enc = new TextEncoder();
+            let sent = false;
+            return { read: async () => {
+              if (sent) return { done: true };
+              sent = true;
+              return { done: false, value: enc.encode(bigIcs) };
+            }, cancel: async () => {} };
+          } },
+          text: async () => bigIcs,
+        }));
+        const res = await fetch(`http://127.0.0.1:${port}/api/v1/calendar/events`);
+        const body = await res.json();
+        expect(res.status).toBe(200); // partial-failure contract
+        expect(body.perSource).toEqual([expect.objectContaining({ sourceId: 'huge', ok: false })]);
+        expect(body.errors.join(' ')).toMatch(/size cap/);
+      });
+    });
+
     test('a failing source degrades to perSource error, others still return', async () => {
       await withServer(async (port, deps) => {
         deps._items.push(
@@ -187,11 +213,18 @@ describe('DC-161 calendar routes', () => {
   });
 
   describe('radicale provision', () => {
-    test('registers an auto-wired source and stores credentials', async () => {
+    test('registers an auto-wired source and stores credentials (verified Radicale container)', async () => {
+      const dockerStub = {
+        client: {
+          getContainer: () => ({
+            inspect: jest.fn(async () => ({ Config: { Image: 'tomsquest/docker-radicale:latest' } })),
+          }),
+        },
+      };
       await withServer(async (port, deps) => {
         const res = await fetch(`http://127.0.0.1:${port}/api/v1/calendar/radicale/provision`, {
           method: 'POST', headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ subdomain: 'calendar', serviceUrl: 'https://calendar.sami' }),
+          body: JSON.stringify({ subdomain: 'calendar', serviceUrl: 'https://calendar.sami', containerId: 'abc123' }),
         });
         const body = await res.json();
         expect(res.status).toBe(200);
@@ -205,7 +238,7 @@ describe('DC-161 calendar routes', () => {
         const root = process.env.DC_RADICALE_CONFIG_ROOT;
         const users = fs.readFileSync(path.join(root, 'config', 'users'), 'utf8');
         expect(users).toContain('dashcaddy:$apr1$');
-      });
+      }, { docker: dockerStub });
     });
 
     test('invalid subdomain is rejected', async () => {
@@ -217,5 +250,57 @@ describe('DC-161 calendar routes', () => {
         expect(res.status).toBe(400);
       });
     });
+
+    test.each([
+      ['missing containerId', { subdomain: 'calendar', serviceUrl: 'https://calendar.sami' }],
+      ['container inspect fails', { subdomain: 'calendar', serviceUrl: 'https://calendar.sami', containerId: 'abc123', _inspect: 'throw' }],
+      ['image is not Radicale', { subdomain: 'calendar', serviceUrl: 'https://calendar.sami', containerId: 'abc123', _image: 'nginx:latest' }],
+    ])('provision fails closed: %s → 409, nothing written or registered', async (_name, body) => {
+      const dockerStub = {
+        client: {
+          getContainer: () => ({
+            inspect: body._inspect === 'throw'
+              ? jest.fn(async () => { throw new Error('no such container'); })
+              : jest.fn(async () => ({ Config: { Image: body._image || 'nginx:latest' } })),
+          }),
+        },
+      };
+      await withServer(async (port, deps) => {
+        const res = await fetch(`http://127.0.0.1:${port}/api/v1/calendar/radicale/provision`, {
+          method: 'POST', headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(body),
+        });
+        expect(res.status).toBe(409);
+        const errBody = await res.json();
+        expect(errBody.error).toMatch(/Refusing to provision/);
+        // Nothing registered, nothing stored, nothing written to the config root
+        expect(deps._items).toHaveLength(0);
+        expect(Object.keys(deps._stored)).toHaveLength(0);
+        const root = process.env.DC_RADICALE_CONFIG_ROOT;
+        expect(fs.existsSync(path.join(root, 'config'))).toBe(false);
+      }, { docker: dockerStub });
+    });
+
+    test('provision succeeds when the inspected image IS Radicale', async () => {
+      const dockerStub = {
+        client: {
+          getContainer: () => ({
+            inspect: jest.fn(async () => ({ Config: { Image: 'tomsquest/docker-radicale:latest' } })),
+          }),
+        },
+      };
+      await withServer(async (port, deps) => {
+        const res = await fetch(`http://127.0.0.1:${port}/api/v1/calendar/radicale/provision`, {
+          method: 'POST', headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ subdomain: 'calendar', serviceUrl: 'https://calendar.sami', containerId: 'abc123' }),
+        });
+        expect(res.status).toBe(200);
+        const body = await res.json();
+        expect(body.source.autoProvisioned).toBe(true);
+        expect(deps._items).toHaveLength(1);
+        const root = process.env.DC_RADICALE_CONFIG_ROOT;
+        expect(fs.existsSync(path.join(root, 'config', 'users'))).toBe(true);
+      }, { docker: dockerStub });
+    });
   });
 });