Report a refused Google grant before a missing calendar on push

A grant refused while no calendar was chosen (for example during calendar
listing) made a later push return no_calendar instead of
google_reconnect_required, sending the household to choose a calendar when
only connecting again helps. grantedConnection now decides the precedence
for every Calendar call that uses the grant (listing, choosing, pushing):
not connected, then a refused grant, then anything else such as no
calendar chosen. It holds the existing cleared-token check, moved out of
accessToken.

Fixes F16-T4-01 for Maestro task b8d8da5a-0450-4571-963e-b3dfead24283.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/gcal/gcaltest/gcaltest.go

@@ -282,6 +282,14 @@ func (g *Google) RejectAccessToken() {
 	g.rejectAccess = true
 }
 
+// AcceptAccessToken undoes RejectAccessToken, as Google does for the grant
+// of a later connection.
+func (g *Google) AcceptAccessToken() {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.rejectAccess = false
+}
+
 // CalendarCalls is how many requests reached the calendarList endpoint.
 func (g *Google) CalendarCalls() int {
 	g.mu.Lock()