fix(gro-48): add missing icalToken to schema and test fixtures

StaffRow now requires icalToken (from iCal calendar feed feature).
Adding icalToken: null to MANAGER mock in groomerIsolation.test.ts,
petPhotos.test.ts, rbac.test.ts, and buildStaff factory. Also adding
icalToken column to staff table schema to match origin/main.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/__tests__/groomerIsolation.test.ts

@@ -21,6 +21,7 @@ const MANAGER: StaffRow = {
   active: true,
   createdAt: new Date(),
   updatedAt: new Date(),
+  icalToken: null,
 };
 
 const GROOMER: StaffRow = {

apps/api/src/__tests__/petPhotos.test.ts

@@ -13,6 +13,7 @@ const MANAGER: StaffRow = {
   active: true,
   createdAt: new Date(),
   updatedAt: new Date(),
+  icalToken: null,
 };
 
 const GROOMER: StaffRow = {

apps/api/src/__tests__/rbac.test.ts

@@ -14,6 +14,7 @@ const MANAGER: StaffRow = {
   active: true,
   createdAt: new Date(),
   updatedAt: new Date(),
+  icalToken: null,
 };
 
 const RECEPTIONIST: StaffRow = {

packages/db/src/factories.ts

@@ -54,6 +54,7 @@ export function buildStaff(overrides: Partial<StaffRow> = {}): StaffRow {
     active: true,
     createdAt: new Date("2025-01-01T00:00:00Z"),
     updatedAt: new Date("2025-01-01T00:00:00Z"),
+    icalToken: null,
     ...overrides,
   };
 }

packages/db/src/schema.ts

@@ -106,6 +106,8 @@ export const staff = pgTable("staff", {
   oidcSub: text("oidc_sub").unique(),
   role: staffRoleEnum("role").notNull().default("groomer"),
   active: boolean("active").notNull().default(true),
+  // Token for iCal calendar feed subscription (no auth required)
+  icalToken: text("ical_token").unique(),
   createdAt: timestamp("created_at").notNull().defaultNow(),
   updatedAt: timestamp("updated_at").notNull().defaultNow(),
 });