Phase 6: write important school events to the Home Assistant calendar

Add the Home Assistant REST calendar client and the idempotent sync that
writes important school events to Sam's Home Assistant calendar (FR-8). The
school stays read-only; the only write is to the calendar (rule 7).

- internal/calendar: HA REST client (states, create_event, get_events,
  delete_event) and the sync that selects important future events, adopts an
  existing event by its description marker, records the HA event id on the
  item, and records every attempt.
- internal/store: migration 003 (items.ha_event_uid, items.ha_pushed_at and
  the append-only calendar_pushes table), candidates, mark-synced and the
  push log.
- internal/parse: a school event is important; a routine class period is not.
- cmd/school: `school calendar entities|status|push|events`.
- web: an "Add to calendar" item action and a fail-loud calendar banner, so a
  failed write is never swallowed (FR-12).
- scripts/calendar-push.sh, Makefile target, env example, docs and tests.

The target is configurable (SCHOOL_HA_CALENDAR_ENTITY). Home Assistant has no
non-Google writable calendar today, so the entity is asked on AUD-110.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

environment.d/school-service.env.example

@@ -28,3 +28,20 @@ SCHOOL_TIMEZONE=Australia/Sydney
 
 SCHOOL_LOG_LEVEL=info
 SCHOOL_APP_ENV=production
+
+# ---- Home Assistant calendar (AGENTS.md §4 FR-8, Phase 6) -------------------
+# Important school events are written to Sam's Home Assistant calendar through
+# the Home Assistant REST API. Nothing is written until all three of URL, token
+# and entity are set; the dashboard shows CALENDAR NOT CONFIGURED until then.
+#
+# The token is a long-lived access token created on Sam's Home Assistant
+# profile page. It is a SECRET: keep it in this file only.
+SCHOOL_HA_URL=http://192.168.20.30:8123
+SCHOOL_HA_TOKEN=
+# The calendar entity to write to. Discover the real ids with:
+#   scripts/calendar-push.sh entities
+SCHOOL_HA_CALENDAR_ENTITY=calendar.school
+# The internal .lab Caddy certificate is not in the container trust store.
+# Set true only when SCHOOL_HA_URL is the https://homeassistant.home.lab URL.
+SCHOOL_HA_INSECURE=false
+SCHOOL_HA_TIMEOUT=20s