Scaffold calcalist: repo, toolchain, config model and doctor

Initialise the project per the approved implementation plan (M0).

- Pin the toolchain with devbox: Rust 1.97.1, pimsync 0.5.11, jujutsu 0.44.0,
  and radicale 3.7.8 for later integration tests.
- Add the configuration model with full referential validation, reporting
  every problem in one pass rather than short-circuiting on the first.
- Add `calcalist doctor`, verifying pimsync's presence and version series,
  the state directory, and the configuration.
- Define the whole CLI surface; only `doctor` acts, the rest exit 2 rather
  than pretending to work.
- Rewrite SPECS.md: Rust naming conventions in place of the JS/TS style
  lines, a `devbox run check` gate instead of a pre-commit hook (jj runs no
  git hooks), and the sync semantics the spec previously left unstated.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

SPECS.md

@@ -0,0 +1,56 @@
+# Calcalist
+
+## Idea
+
+Small Rust based commandline tool with utility systemd service file that can aggregate and sync events between CalDAV/Google Calendar/iCal. Users who have a Google Calendar can create a new calendar that syncs events from several CalDAV calendars. CalDAV users can sync several Google Calendars into one calendar. This should be doable both ways, so the aggregating calendar needs to be able to distinguish where its events came from and also have a way to create new events that get synced to the correct source. In addition iCal feeds can also be aggregated but they remain one way only.
+
+Configuration via a simple web interface. Configuration is saved in a portable toml file that can be easily migrated.
+
+## Architecture
+
+Every endpoint — sources and aggregate targets alike — is mirrored to a local vdir, so the aggregation engine works purely on local files.
+
+- `pimsync` is driven as a one-shot subprocess for the CalDAV and WebCal legs. Its daemon mode is unusable here: it would race the reconciler over the same vdir files, so calcalist owns scheduling.
+- The Google leg is calcalist's own, via the Calendar REST API. pimsync cannot reach Google — it has no REST storage, and its config exposes only HTTP Basic auth, which Google's CalDAV endpoint has rejected since 2025-03-14.
+- Sync state (event mappings, hashes, sync tokens) lives in a JSON sidecar under `$XDG_STATE_HOME/calcalist/`, never in the portable config.
+- Secrets are never stored in the config either. Credentials come from `*_command` fields that are executed to fetch them.
+
+## Sync semantics
+
+| Question | Behaviour |
+|---|---|
+| Provenance | Aggregate UIDs derived as `blake3(aggregate_id, source_id, source_uid)`; the state file is a cache, not a single point of failure |
+| Routing new events | To the aggregate's configured `default_sink`; refused if none is set |
+| Conflicts | Source wins — the origin calendar is authoritative |
+| Deletion | Propagates to the source, guarded by a mass-deletion threshold |
+| Attendees (mirroring) | Kept verbatim on a Google target; demoted to inert data on a CalDAV target |
+| Attendees (routing) | Preserved — the sink server sends real invitations, which is intended |
+| Alarms | Always preserved, with no option to strip them |
+| Retargeting | `sync` refuses on target drift; `aggregate retarget` performs it deliberately |
+
+The governing rule behind the attendee handling: **writes to an aggregate must never emit scheduling mail; writes to a source schedule normally.** Google can be told not to notify, so attendees survive intact there. CalDAV offers no portable way to suppress RFC 6638 scheduling, so inertness is achieved structurally by dropping the live properties instead.
+
+Alarms are never stripped because the whole point of the tool is that a user subscribes to one calendar rather than several — so the duplicate-notification problem that stripping would guard against does not arise, while stripping would silently destroy every reminder in the one calendar the user actually watches.
+
+## Development
+
+Use devbox for dependency management and scripts. Use jj for version control (colocated with git).
+
+- `devbox run fmt` — format.
+- `devbox run check` — format check, clippy with warnings denied, and tests. This is the gate; jj has no commit step to hang a hook off, since the working copy is itself a commit.
+- `devbox run test` — tests only.
+
+Keep `/target` in `.gitignore`: jj snapshots the working copy on every command, with no staging step.
+
+## Coding style
+
+- Simple, readable, idiomatic.
+- Explicit types for public APIs and important fields.
+- Prefer immutable data structures.
+- No global mutable state.
+- No speculative features or dependencies.
+- Keep functions short and single-purpose; extract helpers to avoid nesting.
+- File and module naming: `snake_case.rs`. Types and traits: `PascalCase`. Functions, variables and fields: `snake_case`. Constants: `SCREAMING_SNAKE_CASE`.
+- Run `devbox run check` before describing a change.
+- Comment only when intent is not obvious from the code.
+- Prefer composition and traits over deep type hierarchies.