feat(01-03): implement broker client, syncCalendar, and events route (CAL-01)

- client.ts: createFastmailClient(email, appPassword) → tsdav DAVClient via Basic auth
- sync.ts: syncCalendar upserts calendar row, selects ID, fetches+parses VEVENTs with ical.js
  - all-day DATE → dtstartDate (Date obj at T00:00:00Z), dtstartUtc=null, allDay=true
  - timed → dtstartUtc (JS Date), dtstartDate=null, allDay=false (D-13/Pitfall #3)
  - onDuplicateKeyUpdate on calendarId+uid composite key (idempotent)
- routes/events.ts: GET /api/events reads cache only — no tsdav import (T-03-02)
- tsc --noEmit clean; all 6 sync tests pass

apps/api/src/routes/events.ts

@@ -0,0 +1,29 @@
+/**
+ * GET /api/events — returns cached calendar events from MariaDB.
+ *
+ * Architecture invariant (T-03-02, anti-pattern guard):
+ *   This route reads ONLY from the MariaDB cache. It NEVER calls Fastmail directly.
+ *   All Fastmail I/O is owned exclusively by the broker module (src/broker/).
+ *   No tsdav import here; no createFastmailClient import here.
+ *
+ * Mounted under /api/* in index.ts (Plan 04), so it is behind oidcAuthMiddleware.
+ */
+
+import { Hono } from 'hono'
+import { db } from '../db/client.js'
+import { calendarEvents } from '../db/schema.js'
+
+export const eventsRouter = new Hono()
+
+/**
+ * GET /api/events
+ * Returns all cached calendar events from the database.
+ * Returns shape: { events: [...] } where each event has:
+ *   id, uid, allDay, dtstartUtc, dtstartDate, calendarId, etag, updatedAt
+ *
+ * No live Fastmail call — broker poller keeps cache fresh every 5 minutes.
+ */
+eventsRouter.get('/', async (c) => {
+  const events = await db.select().from(calendarEvents)
+  return c.json({ events })
+})