feat: implement iCal calendar feed (GRO-107)

- Add icalToken column to staff table
- Add public calendar feed endpoint GET /api/calendar/:staffId.ics
- Add token management routes POST/DELETE /api/staff/:id/ical-token
- Hand-build iCal output (RFC 5545)
- Update staff factory with icalToken field

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/db/migrations/0016_ical_token.sql

@@ -0,0 +1 @@
+ALTER TABLE staff ADD COLUMN ical_token TEXT UNIQUE;

packages/db/src/factories.ts

@@ -52,6 +52,7 @@ export function buildStaff(overrides: Partial<StaffRow> = {}): StaffRow {
     oidcSub: `oidc-${id}`,
     role: "groomer",
     active: true,
+    icalToken: null,
     createdAt: new Date("2025-01-01T00:00:00Z"),
     updatedAt: new Date("2025-01-01T00:00:00Z"),
     ...overrides,

packages/db/src/schema.ts

@@ -106,6 +106,8 @@ export const staff = pgTable("staff", {
   oidcSub: text("oidc_sub").unique(),
   role: staffRoleEnum("role").notNull().default("groomer"),
   active: boolean("active").notNull().default(true),
+  // Token for iCal calendar feed subscription (no auth required)
+  icalToken: text("ical_token").unique(),
   createdAt: timestamp("created_at").notNull().defaultNow(),
   updatedAt: timestamp("updated_at").notNull().defaultNow(),
 });