List Google calendars and choose the one to push to (Feature 16)

GET /api/v1/integrations/google/calendars trades the stored refresh token
for an access token, reads every calendarList page and answers
[{id, summary, primary, accessRole}] for writer and owner calendars only.
PUT /api/v1/integrations/google/calendar {calendar_id} validates the id
against that same filtered listing and stores calendar_id and
calendar_name; any other id is 422 unknown_calendar.

Both hold the service's account lock, answer 409 not_connected with
nothing connected, and 502 reconnect_required when Google no longer
accepts the grant, leaving the connection as it is. The gcaltest fake
gains the refresh grant and a pausable calendarList endpoint.

Maestro task 0fe3f1f2-4932-4d10-81dd-74c4f630d215.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/server/main.go

@@ -126,6 +126,7 @@ func run(cfg config.Config, logger *slog.Logger) error {
 		SecretKey:    []byte(cfg.SecretKey.Reveal()),
 		Endpoint:     gcal.GoogleEndpoint,
 		RevokeURL:    gcal.GoogleRevokeURL,
+		CalendarAPI:  gcal.GoogleCalendarAPI,
 	})
 	if err != nil {
 		return err