feat(calendar): add durable subscription runtime

[seonghobae]

Buyer/security outcome

Refs #413. This bounded stacked child composes the calendar-subscription domain (#539) and durable SQLite persistence (#541) into the production server boundary: operators can create, list, rotate, and revoke reusable project-calendar credentials, and calendar clients can use a project/purpose/audience-bound subscription= feed URL instead of a general session credential. It also preserves bounded high-frequency usage evidence inherited from #541, malformed-date hardening, RFC 5545 UTF-8 folding, bounded request bodies, and per-client abuse control.

This PR does not close #413. Customer management UI, final client migration, PostgreSQL parity, and final retirement of the legacy token= compatibility path remain later slices.

Exact current stack

Fresh state after non-destructive parent reconciliation:

• protected develop: 2c328875e00e86537df3e965170be80532571cad;
• exact parent/base fix(calendar): bind omitted purpose to calendar_read #541: cursor/bc-f7050a51-e6e0-448d-bbfa-39c45a93d707-0fd7@1e491bac2fc42b1f17c93666223ce1da78c6ba61;
• exact child head: feat/calendar-subscription-runtime-413@a9743a9a00f54494a12e5f4933519ba26fe1f039;
• parent→child comparison is ahead, zero behind, with exact current parent as merge base;
• effective child scope remains exactly ten paths: ARCHITECTURE.md, CHANGELOG.md, docs/doctoring/calendar-subscription-runtime.md, package.json, server/runtime_app.mjs, server/server.mjs, tests/api/calendar-subscription-body-limit.test.mjs, tests/api/calendar-subscription-rate-limit.test.mjs, tests/api/calendar-subscription-runtime.test.mjs, and tests/unit/coverage-script-contract.test.mjs.

The latest parent changes were inherited with two-parent merge commits rather than force-push/rebase. The child preserves #541's bounded usage-retention source, regression and doctoring changes without widening this PR's unique semantic diff.

The PR remains Draft and mechanically mergeable. All current inline review threads are resolved. There is no qualifying independent current-head/last-push approval.

Runtime/security/interoperability contract

• calendar-subscription schema installation occurs at server bootstrap, never per request;
• the shared SQLite bootstrap already enables PRAGMA foreign_keys = ON before schema installation;
• management accepts bearer-session and PAT identities through shared auth primitives and live persisted revocation state, without the previous internal /api/me self-call;
• owner/admin project-management authority is required and inaccessible projects remain nondisclosing;
• create/rotate reveal the 256-bit random secret once; list/revoke never redisplay plaintext secret, hash, or membership epoch;
• create/rotate JSON bodies are capped at 4 KiB before parsing for both declared and streamed bodies; oversized requests return stable HTTP 413 before durable mutation;
• every runtime-owned management/feed route applies the configured per-client fixed-window abuse ceiling and returns HTTP 429 with Retry-After after exhaustion;
• the reusable feed credential is fixed to one project, calendar_read, and scopeweave:calendar and cannot authorize JSON APIs, SSE, attachments, another project, or another audience;
• subscription= mixed with legacy token= or Authorization fails closed;
• feed responses are private, no-store, no-referrer, and nosniff;
• exact-expiry/revocation and issuance membership_id:token_version epoch are enforced by the domain plus SQLite atomic use transition;
• logout-all invalidates a credential issued under the old session epoch; an authenticated authorized rotation may re-bind a new secret to the new live epoch;
• membership deletion transactionally marks affected subscriptions revoked and writes secret-free revoke evidence;
• inherited SQLite persistence retains only a bounded recent usage window and prevents per-poll used rows from accumulating in the durable lifecycle outbox;
• legacy token= calendar compatibility remains staged and still uses authoritative persisted authentication/session-revocation state;
• RFC 5545 all-day rendering omits non-canonical, impossible, unrepresentable or reversed date ranges; and
• emitted iCalendar content lines fold to at most 75 UTF-8 octets with CRLF+SPACE continuation without splitting a multi-octet character.

Test-first repair evidence

Earlier current-head review found two coupled runtime defects: calendar-owned routes bypassed the core limiter, while management authentication used an internal /api/me request that collapsed clients into the fallback local rate-limit bucket. Registered regression heads failed before production repair. Production repair removed the internal HTTP self-call, uses shared auth/token-version/PAT state directly, and applies per-client limiting to every runtime-owned calendar route. Those review threads remain resolved.

The latest parent repair was independently regression-driven: repeated calendar authorizations had produced unbounded usage and audit rows. #541 now bounds recent usage history and prunes transient per-use outbox rows before commit while retaining its rollback-failure contract; this child inherits that exact source and test registration.

Current behavioral evidence

Current-head-associated runs on a9743a9a00f54494a12e5f4933519ba26fe1f039 are terminal success:

• Server Tests 33124642171 — success; unit-and-api job 98699714141 and cloud-e2e job 98699713925 both passed;
• Dependency Review 33124642201 — success;
• OSV Scanner 33124642390 — success.

The unit/API log includes the inherited bounded-retention regression, expiry, index/race/issuance-epoch/rollback tests, runtime calendar management/feed tests, body-limit tests and route rate-limit tests.

These are behavioral evidence only, not merge authority: the Server Tests run actually fetched and checked out GitHub synthetic merge a453a62d29f3c2a69f59f2acd8977a1c586868c9, not contributor head a9743a9.... ScopeWeave #523 remains the repository-native exact-contributor-head checkout repair; organization-reusable SAST/Security exact-head integrity remains in the existing .github owner path. No predecessor, synthetic-only, status-only, author-only, model-only, pending, skipped, stale or infrastructure-only evidence is promoted to exact-head merge authority.

Exact 100% owned production statement/branch/function/line coverage remains mandatory and must be generated by the applicable coverage gate; ordinary unit/API GREEN does not substitute for that measurement.

Merge gate

Remain Draft. Do not integrate independently of #541/#539/#506. After every parent/base/head movement, reconcile the exact bounded semantic diff non-destructively and regenerate all then-applicable exact-contributor-head repository and organization CI, browser E2E, owned coverage/docstrings, SAST/security/dependency/supply-chain/package/provenance/migration/recovery evidence.

Require zero valid unresolved defects and qualifying independent current-head/last-push approval under live branch protection/rulesets before merge. Pending, queued, skipped-required, cancelled, absent, neutral-required, failed, stale, predecessor, synthetic-only, status-only, author-only, or model-only evidence is non-passing.

Documentation / rollback

docs/doctoring/calendar-subscription-runtime.md records active-PR versus protected-shipped truth, authority/transport boundaries, staged compatibility, RFC 5545 folding/date behavior, recovery/rollback, RED→GREEN evidence and APA 7 references. Rollback must preserve durable subscription lifecycle evidence and must not restore a general session JWT in a calendar URL as the preferred steady state.

[devin-ai-integration]

Devin Review found 4 potential issues.