feat: add Google Calendar push intake

[IYENTeam]

Summary

• add authenticated Google Calendar API push intake at POST /google/calendar
• normalize Calendar watch sync and exists notifications into google.calendar.sync and google.calendar.changed
• preserve channel/resource/message metadata without claiming the body contains changed event details
• add human compact/inline/alert rendering plus setup and routing documentation

Security and protocol behavior

• endpoint returns 503 until [google_calendar].channel_token is configured
• X-Goog-Channel-Token is compared in constant time
• missing or incorrect tokens return 401
• missing required X-Goog-* headers and invalid states/message numbers return 400
• whitespace-only configured tokens normalize away and fail closed
• notifications are documented as at-least-once; downstream Calendar synchronization must be idempotent

Verification

• failing-first normalizer and endpoint proofs captured before implementation
• cargo fmt --all -- --check
• cargo check --all-targets --locked
• cargo clippy --all-targets --locked -- -D warnings
• cargo test --all-targets --locked -q (675 binary tests plus all library/integration targets)
• cargo build --release --locked
• cargo package --locked --allow-dirty
• Markdown relative links and staged diff checks

Manual QA

• unconfigured endpoint: 503
• missing/wrong token: 401
• missing required header: 400
• valid sync and exists: 202
• both events observed through a real localfile route
• compact/inline/alert Calendar output observed without raw JSON fallback

Five independent review lanes (goal, quality, security, hands-on QA, repository context) re-reviewed the final staged patch and returned PASS.

Official protocol reference: https://developers.google.com/workspace/calendar/api/guides/push