feat(lasuite): add calendars service deployment manifests

Add K8s manifests for calendars backend, frontend (Caddy), CalDAV
server, and Celery worker. Wire Pingora routing for cal.sunbeam.pt
with path-based backend/caldav/static splits. Add OAuth2Client for
OIDC, VaultDynamicSecret for DB credentials, VaultStaticSecret for
Django/CalDAV keys, and TLS cert coverage for the cal subdomain.
Register calendars in the integration service gaufre widget.

overlays/production/cert-manager.yaml

@@ -70,3 +70,4 @@ spec:
     - admin.DOMAIN_SUFFIX
     - integration.DOMAIN_SUFFIX
     - livekit.DOMAIN_SUFFIX
+    - cal.DOMAIN_SUFFIX