feat(03-10): wire buildVeventString into dispatch path + fix all-day DTEND+1 (CR-02, WR-04)

- outboxWorker: parse stored form JSON, build VCALENDAR via buildVeventString for create/update
- outboxWorker: return hardFail on payload parse error (corrupt payload never self-resolves)
- outboxWorker: import buildVeventString and RRULE_PRESETS from vevent.js
- vevent.ts: advance all-day DTEND by +1 calendar day (RFC-5545 exclusive end, WR-04 owning boundary)

apps/api/src/broker/outboxWorker.ts

@@ -31,6 +31,7 @@ import { createFastmailClient } from './client.js'
 import { decryptPassword } from './crypto.js'
 import { syncCalendar } from './sync.js'
 import { createCalendarEvent, updateCalendarEvent, deleteCalendarEvent } from './write.js'
+import { buildVeventString, RRULE_PRESETS } from './vevent.js'
 import type { FastmailClient } from './client.js'
 
 // ── Constants (D-07) ────────────────────────────────────────────────────────
@@ -165,10 +166,27 @@ async function dispatchRow(row: OutboxRow): Promise<DispatchResult> {
         error: 'update operation missing payload or calendarObjectUrl',
       }
     }
+    // CR-02: parse the stored form JSON and build a real VCALENDAR string
+    let fields: Record<string, unknown>
+    try {
+      fields = JSON.parse(row.payload) as Record<string, unknown>
+    } catch {
+      return { success: false, conflict: false, hardFail: true, transient: false, error: 'payload parse failed' }
+    }
+    const { icsString } = buildVeventString({
+      uid: row.uid,
+      summary: fields.title as string,
+      allDay: fields.allDay as boolean,
+      dtstart: fields.allDay ? (fields.start as string) : new Date(fields.start as string),
+      dtend: fields.allDay ? (fields.end as string) : new Date(fields.end as string),
+      location: fields.location as string | undefined,
+      description: fields.description as string | undefined,
+      rruleString: fields.recurrence && fields.recurrence !== 'none' ? RRULE_PRESETS[fields.recurrence as string] : undefined,
+    })
     response = await updateCalendarEvent(
       client,
       row.calendarObjectUrl,
-      row.payload,
+      icsString,
       row.etag ?? null,
     )
   } else {
@@ -182,9 +200,26 @@ async function dispatchRow(row: OutboxRow): Promise<DispatchResult> {
         error: 'create operation missing payload',
       }
     }
+    // CR-02: parse the stored form JSON and build a real VCALENDAR string
+    let fields: Record<string, unknown>
+    try {
+      fields = JSON.parse(row.payload) as Record<string, unknown>
+    } catch {
+      return { success: false, conflict: false, hardFail: true, transient: false, error: 'payload parse failed' }
+    }
+    const { icsString } = buildVeventString({
+      uid: row.uid,
+      summary: fields.title as string,
+      allDay: fields.allDay as boolean,
+      dtstart: fields.allDay ? (fields.start as string) : new Date(fields.start as string),
+      dtend: fields.allDay ? (fields.end as string) : new Date(fields.end as string),
+      location: fields.location as string | undefined,
+      description: fields.description as string | undefined,
+      rruleString: fields.recurrence && fields.recurrence !== 'none' ? RRULE_PRESETS[fields.recurrence as string] : undefined,
+    })
     // Build a minimal DAVCalendar for the write wrapper (only url is needed)
     const davCalendar = { url: row.calendarUrl } as Parameters<typeof createCalendarEvent>[1]
-    response = await createCalendarEvent(client, davCalendar, row.uid, row.payload)
+    response = await createCalendarEvent(client, davCalendar, row.uid, icsString)
   }
 
   const status = response.status