feat(05-03): calendar backend — model, crypto, source CRUD module

- Add CalendarSource Prisma model with encrypted credentials (AES-256-GCM)
- Create CalendarCryptoService with encrypt/decrypt using CALENDAR_ENCRYPTION_KEY
- Create CalendarController with source CRUD endpoints (GET/POST/PATCH/DELETE)
- Create CalendarService with ownership checks and SSRF URL validation
- Add DTOs with https-only URL validation and class-validator decorators
- Register CalendarModule in AppModule
- Install tsdav, node-ical, ews-javascript-api, @microsoft/microsoft-graph-client
- Stub provider files for Task 2 compilation

apps/api/src/calendar/providers/ics.provider.ts

@@ -0,0 +1,27 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { CalendarEvent, CalendarProvider } from '../calendar.service';
+
+/**
+ * ICS calendar provider — fetches and parses .ics files via HTTPS.
+ * Uses node-ical for parsing. Full implementation in Task 2.
+ */
+@Injectable()
+export class ICSProvider implements CalendarProvider {
+  private readonly logger = new Logger(ICSProvider.name);
+
+  async fetchEvents(
+    source: { url: string; id: string; color?: string | null },
+    from: Date,
+    to: Date,
+  ): Promise<CalendarEvent[]> {
+    // Stub — implemented in Task 2
+    return [];
+  }
+
+  async testConnection(
+    source: { url: string; id: string },
+  ): Promise<boolean> {
+    // Stub — implemented in Task 2
+    return false;
+  }
+}