Push the week's plan to Google Calendar (Feature 16)

POST /api/v1/plans/{weekStart}/push-calendar writes one event per plan
day to the chosen calendar: "Dinner: {name}" from the household dinner
time for 60 minutes in the household zone, with the dinner name,
"Start by {time}" for crock-pot dinners and the
{MEALQUEST_PUBLIC_URL}/dinner/{id} link. Event ids are the lowercase
base32hex SHA-256 of "mealquest|{weekStart}|{date}"; each event is
inserted, and a 409 updates it instead.

gcal.Service.PushEvents does the Calendar writes under the account lock,
with the same redaction as listing. plan.Service.Push records a push only
when every event was written: the plan becomes synced with
calendar_synced_at and each day stores its event id. A partial failure
records nothing; a plan edited mid-push is 409 plan_changed.

A swap, or a redraft to another dinner, clears the day's
calendar_event_id, so the next push writes just those days; a push with
none pending writes every day again.

No calendar chosen is 409 no_calendar; a deleted or read-only chosen
calendar is 409 calendar_unavailable; a refused grant is 502
reconnect_required, leaving the connection as it is.

Maestro task 5885d2b1-cf06-44ff-abf3-242d7763c3c9.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/gcal/calendars.go

@@ -105,7 +105,11 @@ func (s *Service) SelectCalendar(ctx context.Context, id string) (Selection, err
 // calendars lists the writable calendars, each once, with the stored refresh
 // token. The caller holds s.account.
 func (s *Service) calendars(ctx context.Context) ([]Calendar, error) {
-	access, err := s.accessToken(ctx)
+	row, err := s.connection(ctx)
+	if err != nil {
+		return nil, err
+	}
+	access, err := s.accessToken(ctx, row)
 	if err != nil {
 		return nil, err
 	}
@@ -136,16 +140,21 @@ func (s *Service) calendars(ctx context.Context) ([]Calendar, error) {
 	return nil, &CalendarError{msg: fmt.Sprintf("gcal: Google listed more than %d pages of calendars", maxCalendarPages)}
 }
 
-// accessToken trades the stored refresh token for an access token. A grant
-// Google reports as invalid_grant is ErrReconnect.
-func (s *Service) accessToken(ctx context.Context) (string, error) {
+// connection reads the connected account, or ErrNotConnected.
+func (s *Service) connection(ctx context.Context) (db.IntegrationsGoogle, error) {
 	row, err := db.New(s.st.Reader).GetIntegrationsGoogle(ctx)
 	if errors.Is(err, sql.ErrNoRows) {
-		return "", ErrNotConnected
+		return db.IntegrationsGoogle{}, ErrNotConnected
 	}
 	if err != nil {
-		return "", fmt.Errorf("gcal: read Google integration: %w", err)
+		return db.IntegrationsGoogle{}, fmt.Errorf("gcal: read Google integration: %w", err)
 	}
+	return row, nil
+}
+
+// accessToken trades row's refresh token for an access token. A grant
+// Google reports as invalid_grant is ErrReconnect.
+func (s *Service) accessToken(ctx context.Context, row db.IntegrationsGoogle) (string, error) {
 	refresh, err := s.box.Decrypt(row.RefreshTokenCt)
 	if err != nil {
 		return "", fmt.Errorf("gcal: open refresh token: %w", err)