✨(all) add organizations, resources, channels, and infra migration (#34)

Add multi-tenant organization model populated from OIDC claims with
org-scoped user discovery, CalDAV principal filtering, and cross-org
isolation at the SabreDAV layer.

Add bookable resource principals (rooms, equipment) with CalDAV
auto-scheduling that handles conflict detection, auto-accept/decline,
and org-scoped booking enforcement. Fixes #14.

Replace CalendarSubscriptionToken with a unified Channel model
supporting CalDAV integration tokens and iCal feed URLs, with
encrypted token storage and role-based access control. Fixes #16.

Migrate task queue from Celery to Dramatiq with async ICS import,
progress tracking, and task status polling endpoint.

Replace nginx with Caddy for both the reverse proxy and frontend
static serving. Switch frontend package manager from yarn/pnpm to
npm and upgrade Node to 24, Next.js to 16, TypeScript to 5.9.

Harden security with fail-closed entitlements, RSVP rate limiting
and token expiry, CalDAV proxy path validation blocking internal
API routes, channel path scope enforcement, and ETag-based
conflict prevention.

Add frontend pages for resource management and integration channel
CRUD, with resource booking in the event modal.

Restructure CalDAV paths to /calendars/users/ and
/calendars/resources/ with nested principal collections in SabreDAV.

src/backend/core/signals.py

@@ -2,15 +2,17 @@
 Declare and configure the signals for the calendars core application
 """
 
+import json
 import logging
 
 from django.conf import settings
 from django.contrib.auth import get_user_model
-from django.db.models.signals import post_save
+from django.db import transaction
+from django.db.models.signals import post_save, pre_delete
 from django.dispatch import receiver
 
 from core.entitlements import EntitlementsUnavailableError, get_user_entitlements
-from core.services.caldav_service import CalendarService
+from core.services.caldav_service import CalDAVHTTPClient, CalendarService
 
 logger = logging.getLogger(__name__)
 User = get_user_model()
@@ -32,7 +34,7 @@ def provision_default_calendar(sender, instance, created, **kwargs):  # pylint:
     # never create a calendar if we can't confirm access.
     try:
         entitlements = get_user_entitlements(instance.sub, instance.email)
-        if not entitlements.get("can_access", True):
+        if not entitlements.get("can_access", False):
             logger.info(
                 "Skipped calendar creation for %s (not entitled)",
                 instance.email,
@@ -48,22 +50,45 @@ def provision_default_calendar(sender, instance, created, **kwargs):  # pylint:
     try:
         service = CalendarService()
         service.create_default_calendar(instance)
-        logger.info("Created default calendar for user %s", instance.email)
-    except Exception as e:  # noqa: BLE001  # pylint: disable=broad-exception-caught
-        # In tests, CalDAV server may not be available, so fail silently
-        # Check if it's a database error that suggests we're in tests
-        error_str = str(e).lower()
-        if "does not exist" in error_str or "relation" in error_str:
-            # Likely in test environment, fail silently
-            logger.debug(
-                "Skipped calendar creation for user %s (likely test environment): %s",
-                instance.email,
-                str(e),
+        logger.info("Created default calendar for user %s", instance.pk)
+    except Exception:  # pylint: disable=broad-exception-caught
+        logger.exception(
+            "Failed to create default calendar for user %s",
+            instance.pk,
+        )
+
+
+@receiver(pre_delete, sender=User)
+def delete_user_caldav_data(sender, instance, **kwargs):  # pylint: disable=unused-argument
+    """Schedule CalDAV data cleanup when a user is deleted.
+
+    Uses on_commit so the external CalDAV call only fires after
+    the DB transaction commits — avoids orphaned state on rollback.
+    """
+    email = instance.email
+    if not email:
+        return
+
+    if not settings.CALDAV_INTERNAL_API_KEY:
+        return
+
+    api_key = settings.CALDAV_INTERNAL_API_KEY
+
+    def _cleanup():
+        try:
+            http = CalDAVHTTPClient()
+            http.request(
+                "POST",
+                instance,
+                "internal-api/users/delete",
+                data=json.dumps({"email": email}).encode("utf-8"),
+                content_type="application/json",
+                extra_headers={"X-Internal-Api-Key": api_key},
             )
-        else:
-            # Real error, log it
-            logger.error(
-                "Failed to create default calendar for user %s: %s",
-                instance.email,
-                str(e),
+        except Exception:  # pylint: disable=broad-exception-caught
+            logger.exception(
+                "Failed to clean up CalDAV data for user %s",
+                email,
             )
+
+    transaction.on_commit(_cleanup)