feat(lasuite): add calendars service deployment manifests

Add K8s manifests for calendars backend, frontend (Caddy), CalDAV
server, and Celery worker. Wire Pingora routing for cal.sunbeam.pt
with path-based backend/caldav/static splits. Add OAuth2Client for
OIDC, VaultDynamicSecret for DB credentials, VaultStaticSecret for
Django/CalDAV keys, and TLS cert coverage for the cal subdomain.
Register calendars in the integration service gaufre widget.

base/lasuite/calendars-worker-deployment.yaml

@@ -0,0 +1,88 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: calendars-worker
+  namespace: lasuite
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: calendars-worker
+  template:
+    metadata:
+      labels:
+        app: calendars-worker
+    spec:
+      containers:
+        - name: calendars-worker
+          image: calendars-backend
+          command: ["python", "worker.py"]
+          envFrom:
+            - configMapRef:
+                name: calendars-config
+            - configMapRef:
+                name: lasuite-postgres
+            - configMapRef:
+                name: lasuite-oidc-provider
+          env:
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: calendars-db-credentials
+                  key: password
+            - name: DJANGO_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: calendars-django-secret
+                  key: DJANGO_SECRET_KEY
+            - name: SALT_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: calendars-django-secret
+                  key: SALT_KEY
+            - name: CALDAV_INBOUND_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: calendars-django-secret
+                  key: CALDAV_INBOUND_API_KEY
+            - name: CALDAV_OUTBOUND_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: calendars-django-secret
+                  key: CALDAV_OUTBOUND_API_KEY
+            - name: CALDAV_INTERNAL_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: calendars-django-secret
+                  key: CALDAV_INTERNAL_API_KEY
+            - name: OIDC_RP_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-calendars
+                  key: CLIENT_ID
+            - name: OIDC_RP_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-calendars
+                  key: CLIENT_SECRET
+          volumeMounts:
+            - name: theme
+              mountPath: /app/theme.json
+              subPath: theme.json
+            - name: translations
+              mountPath: /data/translations.json
+              subPath: translations.json
+          resources:
+            limits:
+              memory: 256Mi
+              cpu: 300m
+            requests:
+              memory: 128Mi
+              cpu: 50m
+      volumes:
+        - name: theme
+          configMap:
+            name: calendars-theme
+        - name: translations
+          configMap:
+            name: calendars-translations