Idempotent booking, write-only retry

Parent: connector

Calendar events.insert is non-idempotent: if the connection drops after Google created the event but before the response, a blind retry double-books. So the idempotency key is generated once, before any retry loop, and reused across the 401-refresh + retry cycle; and the write retry policy only retries pre-send transport errors, never 5xx (which may already have succeeded server-side) — it fails gracefully instead (connector/openapi_adapter.go — newIdempotencyKey, one per InsertEvent call; protocol_caldav.go reuses the same key as the VEVENT UID; retrypolicy.go calendarWritePolicy. The old connector/calendar.go was deleted on 2026-06-27, bca9b1c69).

Related: bookings are an append-only quota ledger (ephemeral-over-stateful); a revoked OAuth grant is a soft disconnect (clear tokens, keep client id/secret so the owner can re-authorize without re-setup).