feat(05-03): calendar backend — model, crypto, source CRUD module

- Add CalendarSource Prisma model with encrypted credentials (AES-256-GCM)
- Create CalendarCryptoService with encrypt/decrypt using CALENDAR_ENCRYPTION_KEY
- Create CalendarController with source CRUD endpoints (GET/POST/PATCH/DELETE)
- Create CalendarService with ownership checks and SSRF URL validation
- Add DTOs with https-only URL validation and class-validator decorators
- Register CalendarModule in AppModule
- Install tsdav, node-ical, ews-javascript-api, @microsoft/microsoft-graph-client
- Stub provider files for Task 2 compilation

apps/api/prisma/schema.prisma

@@ -146,3 +146,25 @@ model SearchProvider {
 
   @@index([userId])
 }
+
+model CalendarSource {
+  id                String    @id @default(uuid())
+  userId            String
+  tenantId          String
+  name              String
+  type              String    // 'caldav' | 'ics' | 'exchange'
+  exchangeMode      String?   // 'ews' | 'graph' — only for exchange type
+  url               String
+  username          String?
+  encryptedPassword String?   // AES-256-GCM ciphertext (iv:authTag:ciphertext hex)
+  color             String?   @default("#3B82F6")
+  isVisible         Boolean   @default(true)
+  syncIntervalMin   Int       @default(15)
+  lastSyncAt        DateTime?
+  lastSyncError     String?
+  createdAt         DateTime  @default(now())
+  updatedAt         DateTime  @updatedAt
+
+  @@index([userId])
+  @@index([tenantId])
+}