Handle Google token failures and report Google Calendar status

When Google refuses the stored grant (invalid_grant on refresh, or HTTP
401 from the Calendar API to the access token just refreshed) on any
Calendar call - listing, choosing or pushing - the connection becomes
reconnect required under the account lock: the refresh token is cleared
and last_sync_error set to "Google access was revoked or expired —
reconnect". The call answers 409 google_reconnect_required, and later
calls answer the same without contacting Google until a reconnect or a
disconnect. The chosen calendar and stored calendar event ids are kept:
the pushed events are still on that calendar, so forgetEvents is not
run.

HTTP 429 and 5xx from the token endpoint or the Calendar API are retried
at most twice with backoff, then answered 503 google_unavailable,
retryable, without clearing or disconnecting anything.

Add GET /api/v1/integrations/google, reporting not_connected, connected
or reconnect_required with the chosen calendar and last_sync_error.

Migration 0015 rebuilds integrations_google so refresh_token_ct can be
cleared, with a CHECK that a row without a token carries the reason.

Maestro task b8d8da5a-0450-4571-963e-b3dfead24283.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/db/querier.go

@@ -17,6 +17,10 @@ type Querier interface {
 	ClaimNextJob(ctx context.Context, now sql.NullString) (Job, error)
 	// Clears every day's calendar event id: none is on the chosen calendar.
 	ClearCalendarEvents(ctx context.Context, updatedAt string) error
+	// Records that Google refuses the stored grant: clears the refresh token and
+	// sets last_sync_error, keeping the chosen calendar. Affects no row when
+	// nothing is connected.
+	ClearIntegrationsGoogleToken(ctx context.Context, arg ClearIntegrationsGoogleTokenParams) (int64, error)
 	// Drops references to the runs created before the cutoff, so the purge
 	// can delete them.
 	ClearSuggestionBatchAIRunsBefore(ctx context.Context, cutoff string) (int64, error)

internal/db/settings.sql.go

@@ -10,6 +10,28 @@ import (
 	"database/sql"
 )
 
+const clearIntegrationsGoogleToken = `-- name: ClearIntegrationsGoogleToken :execrows
+UPDATE integrations_google
+SET refresh_token_ct = NULL, last_sync_error = ?, updated_at = ?
+WHERE id = 1
+`
+
+type ClearIntegrationsGoogleTokenParams struct {
+	LastSyncError sql.NullString
+	UpdatedAt     string
+}
+
+// Records that Google refuses the stored grant: clears the refresh token and
+// sets last_sync_error, keeping the chosen calendar. Affects no row when
+// nothing is connected.
+func (q *Queries) ClearIntegrationsGoogleToken(ctx context.Context, arg ClearIntegrationsGoogleTokenParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, clearIntegrationsGoogleToken, arg.LastSyncError, arg.UpdatedAt)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
 const deleteIntegrationsGoogle = `-- name: DeleteIntegrationsGoogle :exec
 DELETE FROM integrations_google
 WHERE id = 1