feat(caldav): auto-discover Google CalDAV calendars from email accounts

[Katsoragi]

Summary

This PR enables automatic discovery of Google CalDAV accounts when a Google IMAP email account is connected. It dynamically maps to the CalDAV v2 endpoint (apidata.googleusercontent.com/caldav/v2) for Google OAuth accounts, and automatically falls back to the legacy DAV endpoint (www.google.com/calendar/dav) for standard Basic Auth (App Passwords) since Google's v2 endpoint restricts basic auth.

Additionally, this PR adds Google Calendar syncing support via OAuth bearer tokens, maps travel-related intents (flights, hotels, bookings, trips, etc.) to the email and calendar domains, and handles common calendar spelling variations (e.g. callender, calender, calander) in the agent request classifier.

Target branch

• This PR targets dev, not main. All PRs land in dev; main is curated by the maintainer at each release. If your PR is on main by accident, click "Edit" on this PR and change the base.

Linked Issue

Fixes #4908

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)
• New feature (non-breaking — adds new behaviour)
• Breaking change (changes or removes existing behaviour)
• Refactor / cleanup (behaviour unchanged)
• Documentation only
• CI / tooling / configuration

Checklist

• I searched open issues and open PRs — this is not a duplicate.
• This PR targets dev
• My changes are limited to the scope described above — no unrelated refactors or whitespace changes mixed in.
• I actually ran the app (docker compose up or uvicorn app:app) and verified the change works end-to-end. Type-checks and unit tests are not enough.

How to Test

1. Add a Google IMAP email account with an App Password or OAuth.
2. Go to Calendar Settings.
3. Observe that Google CalDAV is automatically discovered, using www.google.com/calendar/dav for App Passwords (Basic Auth) or apidata.googleusercontent.com/caldav/v2 for OAuth.
4. Click test connection and verify the connection is successful and calendars are loaded.

Checks Run

• Run pytest suite: pytest tests/test_caldav_redirect_hardening.py (Passed).
• Verified unified DAVClient construction in src/caldav_sync.py to preserve strict redirect and SSRF hardening.