feat(03-10): wire buildVeventString into dispatch path + fix all-day DTEND+1 (CR-02, WR-04)

- outboxWorker: parse stored form JSON, build VCALENDAR via buildVeventString for create/update
- outboxWorker: return hardFail on payload parse error (corrupt payload never self-resolves)
- outboxWorker: import buildVeventString and RRULE_PRESETS from vevent.js
- vevent.ts: advance all-day DTEND by +1 calendar day (RFC-5545 exclusive end, WR-04 owning boundary)

apps/api/src/broker/vevent.ts

@@ -80,10 +80,19 @@ export function buildVeventString(params: NewEventParams): { uid: string; icsStr
     const [sy, sm, sd] = startStr.split('-').map(Number) as [number, number, number]
     const [ey, em, ed] = endStr.split('-').map(Number) as [number, number, number]
 
+    // WR-04 (owning boundary): RFC-5545 §3.6.1 — DTEND for an all-day event is the
+    // EXCLUSIVE end date. Advance the user-entered inclusive end by one calendar day.
+    // Building a Date from UTC components ensures no DST ambiguity during the roll-over.
+    const endDate = new Date(Date.UTC(ey, em - 1, ed))
+    endDate.setUTCDate(endDate.getUTCDate() + 1)
+    const ey2 = endDate.getUTCFullYear()
+    const em2 = endDate.getUTCMonth() + 1
+    const ed2 = endDate.getUTCDate()
+
     // ICAL.Timezone.localTimezone is passed as the zone arg required by TS types.
     // isDate:true suppresses any time/TZID output regardless of zone. (D-13)
     const startTime = new ICAL.Time({ year: sy, month: sm, day: sd, isDate: true }, ICAL.Timezone.localTimezone)
-    const endTime = new ICAL.Time({ year: ey, month: em, day: ed, isDate: true }, ICAL.Timezone.localTimezone)
+    const endTime = new ICAL.Time({ year: ey2, month: em2, day: ed2, isDate: true }, ICAL.Timezone.localTimezone)
     vevent.addPropertyWithValue('dtstart', startTime)
     vevent.addPropertyWithValue('dtend', endTime)
   } else {