feat(01-04): wire broker + routes into bootstrap, add SSE endpoint, EventProof

- Mount /api/events, /api/sse in index.ts behind oidcAuthMiddleware; /callback + /health before guard
- Call startBrokerPoller() on boot (5-min ctag-poll background schedule)
- Add sseRouter with GET /heartbeat (streamSSE, 10s interval) for Pangolin SSE smoke test (D-08, T-04-01)
- Add CAL-08 spike script (broker/spike.ts): createFastmailClient → fetchCalendars → print calendar URLs
- Add fetchEvents() to pwa/api/client.ts with typed CalendarEvent/EventsResponse shapes
- Add EventProof.tsx: React Query ['events'], renders first event title+date or empty-state (CAL-01 broker proof)
- Update App.tsx to render MemberBadge + EventProof on landing page
- Add ical.js@2.2.1 to PWA dependencies for VEVENT summary parsing in EventProof
- All 24 API unit tests green; tsc --noEmit clean in both apps/api and apps/pwa

apps/pwa/src/App.tsx

@@ -1,5 +1,6 @@
 import { useQuery } from '@tanstack/react-query'
 import { fetchMe, type MeUser } from './api/client'
+import { EventProof } from './components/EventProof'
 
 interface HealthResponse {
   ok: boolean
@@ -85,6 +86,11 @@ export default function App() {
         <MemberBadge user={meQuery.data.user} />
       )}
 
+      {/* Broker proof: one cached Fastmail event (CAL-01) */}
+      <div style={{ marginBottom: '1rem' }}>
+        <EventProof />
+      </div>
+
       {/* Stack health indicator (from Plan 01) */}
       <div
         style={{