fix(03): correct event-write timezone + per-user calendar identity (Gate 2 Part D)

BUG A — timed events written 4h off: EventForm sent a naive local wall-clock
string with no offset; the UTC API container parsed it via new Date() as UTC, so
09:00 America/Toronto serialized to DTSTART:...090000Z. Fix: new
apps/pwa/src/lib/eventDateTime.ts serializes timed events to an unambiguous UTC
instant in the browser (where the operator's zone is known); all-day stays a DATE
string. No backend change.

BUG B — created events attached to the wrong user's calendar + duplicate calendar
rows per poll: calendars had no unique key on url, and poller/sync matched
calendars by url alone — so under the shared single Fastmail account (D-16) one
member's collection resolved to the other member's row. Fix: composite
unique(user_id, url); scope poller lookup + sync select to (userId, url); hand
migration 0001 (dedup + add key), applied to the live DB.

Regression tests fail against the buggy url-only predicate. API 98/98, PWA 140/140,
tsc clean both packages.

apps/api/tests/broker/poller.test.ts

@@ -194,6 +194,44 @@ describe('broker poller — runPoll', () => {
     expect(mockSyncCalendar).not.toHaveBeenCalled()
   })
 
+  it('BUG B: scopes the stored-calendar lookup to (userId, url), not url alone', async () => {
+    // Capture the predicate passed to db.select().from(calendars).where(...).
+    // The buggy code passed eq(url) only; the fix passes and(eq(userId), eq(url)).
+    // We serialize the predicate and assert it references the member's user_id column.
+    const capturedWhere: unknown[] = []
+    mockSelectWhere.mockImplementation((pred: unknown) => {
+      capturedWhere.push(pred)
+      return { limit: mockSelectLimit }
+    })
+
+    const { runPoll } = await import('../../src/broker/poller.js')
+
+    mockCredentialsSelectResult.push({
+      id: 7,
+      userId: 42,
+      fastmailEmail: 'lucas@fastmail.com',
+      encryptedPassword: 'enc',
+    })
+
+    mockFetchCalendars.mockResolvedValue([
+      { url: 'https://caldav.fastmail.com/cal/', displayName: 'Calendar', ctag: 'c', syncToken: null },
+    ])
+
+    await runPoll()
+
+    expect(capturedWhere.length).toBeGreaterThan(0)
+    // A composite and(...) predicate exposes multiple queryChunks; a single eq does not
+    // contain a nested SQL referencing the user_id column. Serialize and inspect.
+    const pred = capturedWhere[0] as { queryChunks?: unknown[] }
+    const serialized = JSON.stringify(pred, (_k, v) =>
+      typeof v === 'object' && v !== null && 'name' in (v as Record<string, unknown>)
+        ? (v as { name?: unknown }).name
+        : v,
+    )
+    expect(serialized).toContain('user_id')
+    expect(serialized).toContain('url')
+  })
+
   it('processes all member credentials in a poll cycle', async () => {
     const { runPoll } = await import('../../src/broker/poller.js')