Google Calendar event projection via the outbox queue

The second outbound projection, using the service-account pattern proved in phase 0. Writes go only to the Orrey calendar — **never to the user's Social calendar.**

- [ ] Queue message shape for "project session N to Google"; same producer as the Discord event projection.
- [ ] Deterministic base32hex event id per session, stored in `calendar_links.gcal_event_id`.
- [ ] Upsert: `insert`, and on `409` `update`. Fingerprint the content; skip when unchanged; record `synced_at` / `last_error`.
- [ ] Service-account JWT → access token, cached for its lifetime in the Worker (no refresh token exists to expire).
- [ ] Idempotent on redelivery; failures to the DLQ with `last_error` set.

Echo-loop prevention (the Google *return* path) is phase 7; the fingerprint stored here is what makes that possible later.