Add calendar app — shared events calendar with departments, staff tagging, bank holidays and two-way phone sync

Fastify/Postgres backend + React frontend matching the stack's app conventions, plus
a hand-rolled RFC 4791 CalDAV server (caldav-adapter turned out Koa-only in practice)
so calendars subscribe as genuine two-way sync in Apple/Google/Outlook. v1 scope:
multiple colour-coded calendars, department/staff event tagging via live Workforce
lookups, month/week/day/list views, dashboard, file attachments, activity log, and
an auto-synced UK bank holidays calendar. Verified end-to-end locally against real
Postgres: REST CRUD, CalDAV discovery/PROPFIND/REPORT/PUT/sync-collection, all-day
date handling, system-calendar write protection, and activity logging across both
the web and CalDAV write paths.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

seed-app.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+// Run from calendar/ dir: DATABASE_URL=... node seed-app.js
+//
+// NOTE: this follows the *actual* auth schema (role_capabilities has a
+// capability_id column — see auth/src/db.js) rather than maintenance/ and
+// room-planner/'s seed-app.js, which both insert into a non-existent
+// `cap_id` column. Copied the 3-step pattern, fixed the column name.
+import pg from 'pg'
+
+const { Pool } = pg
+const pool = new Pool({ connectionString: process.env.DATABASE_URL })
+
+await pool.query(`
+  INSERT INTO apps (slug, name, description, base_path, icon, theme_color, category, internal_host, internal_port)
+  VALUES ('calendar', 'Calendar', 'Shared events calendar — departments, staff, bank holidays, phone sync', '/calendar', 'CalendarDays', '#c9a84c', 'Operations', '10.10.10.126', 3080)
+  ON CONFLICT (slug) DO UPDATE SET
+    name          = EXCLUDED.name,
+    description   = EXCLUDED.description,
+    base_path     = EXCLUDED.base_path,
+    icon          = EXCLUDED.icon,
+    theme_color   = EXCLUDED.theme_color,
+    category      = EXCLUDED.category,
+    internal_host = EXCLUDED.internal_host,
+    internal_port = EXCLUDED.internal_port
+`)
+
+// Seed capabilities
+await pool.query(`
+  INSERT INTO app_capabilities (app_id, slug, name, description, sort_order)
+  SELECT a.id, c.slug, c.name, c.description, c.sort_order
+  FROM apps a, (VALUES
+    ('view',              'View Calendar',              'View events, calendars and bank holidays',        1),
+    ('create',            'Create Events',              'Add new events to non-system calendars',          2),
+    ('edit',              'Edit Events',                'Edit, delete and attach files to events; manage own CalDAV credentials', 3),
+    ('manage_calendars',  'Manage Calendars',            'Create, rename, recolour and delete calendars',   4),
+    ('admin',             'View Activity Log & Admin',   'View the full activity/audit log',                5)
+  ) AS c(slug, name, description, sort_order)
+  WHERE a.slug = 'calendar'
+  ON CONFLICT (app_id, slug) DO UPDATE SET
+    name        = EXCLUDED.name,
+    description = EXCLUDED.description,
+    sort_order  = EXCLUDED.sort_order
+`)
+
+// Grant view + create to Staff role if they have no calendar caps yet
+await pool.query(`
+  INSERT INTO role_capabilities (role_id, capability_id)
+  SELECT r.id, ac.id
+  FROM roles r
+  JOIN app_capabilities ac ON ac.app_id = (SELECT id FROM apps WHERE slug = 'calendar')
+  JOIN apps a ON a.id = ac.app_id
+  WHERE r.slug = 'staff'
+    AND ac.slug IN ('view', 'create')
+    AND NOT EXISTS (
+      SELECT 1 FROM role_capabilities rc
+      JOIN app_capabilities ac2 ON ac2.id = rc.capability_id
+      WHERE rc.role_id = r.id AND ac2.app_id = a.id
+    )
+  ON CONFLICT DO NOTHING
+`)
+
+console.log('calendar app seeded.')
+await pool.end()