feat(01-04): wire broker + routes into bootstrap, add SSE endpoint, EventProof

- Mount /api/events, /api/sse in index.ts behind oidcAuthMiddleware; /callback + /health before guard
- Call startBrokerPoller() on boot (5-min ctag-poll background schedule)
- Add sseRouter with GET /heartbeat (streamSSE, 10s interval) for Pangolin SSE smoke test (D-08, T-04-01)
- Add CAL-08 spike script (broker/spike.ts): createFastmailClient → fetchCalendars → print calendar URLs
- Add fetchEvents() to pwa/api/client.ts with typed CalendarEvent/EventsResponse shapes
- Add EventProof.tsx: React Query ['events'], renders first event title+date or empty-state (CAL-01 broker proof)
- Update App.tsx to render MemberBadge + EventProof on landing page
- Add ical.js@2.2.1 to PWA dependencies for VEVENT summary parsing in EventProof
- All 24 API unit tests green; tsc --noEmit clean in both apps/api and apps/pwa

apps/api/src/index.ts

@@ -3,25 +3,34 @@ import { serveStatic } from '@hono/node-server/serve-static'
 import { Hono } from 'hono'
 import { healthRouter } from './routes/health.js'
 import { meRouter } from './routes/me.js'
+import { eventsRouter } from './routes/events.js'
+import { sseRouter } from './routes/sse.js'
 import { oidcAuthMiddleware, processOAuthCallback } from './auth/middleware.js'
+import { startBrokerPoller } from './broker/poller.js'
 
 export const app = new Hono()
 
-// GET /health — unauthenticated, mounted BEFORE the OIDC guard (T-01-03, T-02-05)
-app.route('/health', healthRouter)
-
 // OIDC callback — must be registered BEFORE oidcAuthMiddleware so the
 // authorization-code exchange is not itself intercepted by the auth check (T-02-02)
 app.get('/callback', (c) => processOAuthCallback(c))
 
+// GET /health — unauthenticated, mounted BEFORE the OIDC guard (T-01-03, T-02-05)
+app.route('/health', healthRouter)
+
 // Protect all /api/* routes with OIDC session middleware (AUTH-01, T-02-05).
 // Unauthenticated requests receive a 302 redirect to Authelia's authorize endpoint.
 // OIDC_AUTH_EXTERNAL_URL is MANDATORY behind Pangolin to construct the correct
 // redirect_uri (Pitfall 1). Set it to https://familysync.<domain>.
 app.use('/api/*', oidcAuthMiddleware())
 
-// Protected API routes
+// Protected API routes (behind oidcAuthMiddleware)
 app.route('/api/me', meRouter)
+app.route('/api/events', eventsRouter)
+app.route('/api/sse', sseRouter)
+
+// Start the CalDAV broker poller (5-min cron, D-13 ctag change-detection)
+// Runs in the background — errors are caught and logged per-credential (T-03-04)
+startBrokerPoller()
 
 // Serve React PWA static assets from ./public (Vite build output)
 app.use('/assets/*', serveStatic({ root: './public' }))