feat(lasuite): add calendars service deployment manifests

Add K8s manifests for calendars backend, frontend (Caddy), CalDAV
server, and Celery worker. Wire Pingora routing for cal.sunbeam.pt
with path-based backend/caldav/static splits. Add OAuth2Client for
OIDC, VaultDynamicSecret for DB credentials, VaultStaticSecret for
Django/CalDAV keys, and TLS cert coverage for the cal subdomain.
Register calendars in the integration service gaufre widget.

base/lasuite/oidc-clients.yaml

@@ -178,3 +178,25 @@ spec:
   scope: openid
   tokenEndpointAuthMethod: client_secret_basic
   secretName: oidc-hive
+---
+# ── Calendars ────────────────────────────────────────────────────────────────
+apiVersion: hydra.ory.sh/v1alpha1
+kind: OAuth2Client
+metadata:
+  name: calendars
+  namespace: lasuite
+spec:
+  clientName: Calendars
+  grantTypes:
+    - authorization_code
+    - refresh_token
+  responseTypes:
+    - code
+  scope: openid email profile
+  redirectUris:
+    - https://cal.DOMAIN_SUFFIX/api/v1.0/callback/
+  postLogoutRedirectUris:
+    - https://cal.DOMAIN_SUFFIX/api/v1.0/logout-callback/
+  tokenEndpointAuthMethod: client_secret_post
+  secretName: oidc-calendars
+  skipConsent: true