Handle Google token failures and report Google Calendar status

When Google refuses the stored grant (invalid_grant on refresh, or HTTP
401 from the Calendar API to the access token just refreshed) on any
Calendar call - listing, choosing or pushing - the connection becomes
reconnect required under the account lock: the refresh token is cleared
and last_sync_error set to "Google access was revoked or expired —
reconnect". The call answers 409 google_reconnect_required, and later
calls answer the same without contacting Google until a reconnect or a
disconnect. The chosen calendar and stored calendar event ids are kept:
the pushed events are still on that calendar, so forgetEvents is not
run.

HTTP 429 and 5xx from the token endpoint or the Calendar API are retried
at most twice with backoff, then answered 503 google_unavailable,
retryable, without clearing or disconnecting anything.

Add GET /api/v1/integrations/google, reporting not_connected, connected
or reconnect_required with the chosen calendar and last_sync_error.

Migration 0015 rebuilds integrations_google so refresh_token_ct can be
cleared, with a CHECK that a row without a token carries the reason.

Maestro task b8d8da5a-0450-4571-963e-b3dfead24283.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/gcal/gcaltest/gcaltest.go

@@ -76,17 +76,22 @@ type Google struct {
 	calendars []Calendar
 	pageSize  int
 	// calendarStatus, when not 200, fails the calendarList endpoint with a
-	// body that quotes the access token.
+	// body that quotes the access token: every request when calendarFails
+	// is 0, else the next calendarFails requests.
 	calendarStatus int
+	calendarFails  int
 	calendarCalls  int
+	// rejectAccess makes the Calendar API answer HTTP 401 to every access
+	// token, while the grant stays live at the token endpoint.
+	rejectAccess bool
 	// events holds each calendar's events by id.
 	events map[string]map[string]Event
 	// inserts and updates count the events created and updated.
 	inserts, updates int
 	// eventWrites counts the requests that reached the events endpoints;
-	// failWrite, when not 0, fails the request that makes it that count
-	// with failStatus and a body that quotes the access token.
-	eventWrites, failWrite, failStatus int
+	// failWrite, when not 0, fails the requests that make it that count up
+	// to failLast with failStatus and a body that quotes the access token.
+	eventWrites, failWrite, failLast, failStatus int
 	// eventHold, when set, stops the next events request.
 	eventHold *hold
 }
@@ -257,7 +262,24 @@ func (g *Google) SetCalendars(pageSize int, cals ...Calendar) {
 func (g *Google) FailCalendarList(status int) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
-	g.calendarStatus = status
+	g.calendarStatus, g.calendarFails = status, 0
+}
+
+// FailCalendarListNext makes the next n calendarList requests answer status
+// as FailCalendarList does, and later ones answer normally.
+func (g *Google) FailCalendarListNext(n, status int) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.calendarStatus, g.calendarFails = status, n
+}
+
+// RejectAccessToken makes the Calendar API answer HTTP 401 to every access
+// token while refreshing the grant still succeeds, as Google does when it
+// refuses the access token it just issued.
+func (g *Google) RejectAccessToken() {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.rejectAccess = true
 }
 
 // CalendarCalls is how many requests reached the calendarList endpoint.
@@ -315,9 +337,23 @@ func (g *Google) CancelEvent(calendar, id string) {
 // FailEventWrite makes the nth request to the events endpoints from now
 // (1 for the next) answer status with a body that quotes the access token.
 func (g *Google) FailEventWrite(n, status int) {
+	g.FailEventWrites(n, 1, status)
+}
+
+// FailEventWrites makes count requests to the events endpoints in a row,
+// from the nth from now (1 for the next), answer status with a body that
+// quotes the access token.
+func (g *Google) FailEventWrites(n, count, status int) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
-	g.failWrite, g.failStatus = g.eventWrites+n, status
+	g.failWrite, g.failLast, g.failStatus = g.eventWrites+n, g.eventWrites+n+count-1, status
+}
+
+// EventRequests is how many requests reached the events endpoints.
+func (g *Google) EventRequests() int {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return g.eventWrites
 }
 
 // HoldEvents stops the next request to the events endpoints before it is
@@ -476,16 +512,22 @@ func (g *Google) calendarList(w http.ResponseWriter, r *http.Request) {
 	g.calendarHold = nil
 	g.wait(h)
 	auth := r.Header.Get("Authorization")
-	if auth != "Bearer "+AccessToken || !g.grantLive() {
+	if auth != "Bearer "+AccessToken || !g.grantLive() || g.rejectAccess {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusUnauthorized)
 		fmt.Fprintf(w, `{"error":{"code":401,"message":"Invalid Credentials: %s"}}`, auth)
 		return
 	}
-	if g.calendarStatus != http.StatusOK {
+	if status := g.calendarStatus; status != http.StatusOK {
+		if g.calendarFails > 0 {
+			g.calendarFails--
+			if g.calendarFails == 0 {
+				g.calendarStatus = http.StatusOK
+			}
+		}
 		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(g.calendarStatus)
-		fmt.Fprintf(w, `{"error":{"code":%d,"message":"echo %s"}}`, g.calendarStatus, auth)
+		w.WriteHeader(status)
+		fmt.Fprintf(w, `{"error":{"code":%d,"message":"echo %s"}}`, status, auth)
 		return
 	}
 	start := 0
@@ -598,11 +640,11 @@ func (g *Google) eventCalendar(w http.ResponseWriter, r *http.Request) (string,
 	g.eventHold = nil
 	g.wait(h)
 	auth := r.Header.Get("Authorization")
-	if auth != "Bearer "+AccessToken || !g.grantLive() {
+	if auth != "Bearer "+AccessToken || !g.grantLive() || g.rejectAccess {
 		apiError(w, http.StatusUnauthorized, "authError", "Invalid Credentials: "+auth)
 		return "", false
 	}
-	if g.failWrite != 0 && g.eventWrites == g.failWrite {
+	if g.failWrite != 0 && g.eventWrites >= g.failWrite && g.eventWrites <= g.failLast {
 		apiError(w, g.failStatus, "backendError", "echo "+auth)
 		return "", false
 	}