P4: calendar write-back to Radicale, site-owned UIDs only

The site becomes a second writer to scouts/site73, as the scoped scoutsite
principal (rw on that one collection, denied everywhere else by the rights
file). Two rules enforced in calendar_write.py, not left to callers: the
site owns only UIDs ending @site73.greenlanescouts73.org and refuses any
other before a network call, the same shape as band-cal-sync and @band.us;
and with no RADICALE_* configuration every write is a 503, never a silent
no-op.

The VEVENT layout matches seed.py exactly so the feed reverses it into the
row shape the public pages already render: all-day DTEND exclusive, TZID +
VTIMEZONE on timed events, 90-minute default for a timed one-day event,
noon on the end date for a timed multi-day one, CATEGORIES for the unit,
X-SCOUT73-BADGE, 75-octet folding. Reads come from the scout-calendar feed
(now carrying uid and recurring); rows the site created and that are not
part of a series are marked mine. Writes are logged to auth_events and
bust the page cache so a leader sees their event within the feed's minute.

DELETE really deletes - the calendar's history is Radicale's git log.
Endpoints under calendar:write. tests/smoke_admin.py 78 -> 102. Proven
against the real store on a 2036 probe (outside the feed window): create,
read back byte-for-byte, replace, delete, second delete 404, foreign UID
403 with no store call, unconfigured 503.

docker-compose.yml

@@ -46,6 +46,11 @@ services:
       # forwarded here; adding it to the stack alone is not enough.
       - ADMIN_BOOTSTRAP_EMAIL=${ADMIN_BOOTSTRAP_EMAIL}
       - SITE_BASE_URL=${SITE_BASE_URL}
+      # P4 calendar write-back. The scoped `scoutsite` Radicale principal, rw
+      # on scouts/site73 only. Unset = every calendar write is a 503.
+      - RADICALE_URL=${RADICALE_URL}
+      - RADICALE_USER=${RADICALE_USER}
+      - RADICALE_PASS=${RADICALE_PASS}
     volumes:
       - /srv/scout-website/data:/data
       - /srv/scout-website/secrets/service_account.json:/app/service_account.json:ro