fix: suppress reminders for cancelled Google events - #133

ℹ️ No critical issues — one rough edge worth a look.

Reviewed changes

• Worker seam — worker.WithReminderCheck adds a callback run before sendReminder sends; false suppresses, error follows the job's retry policy. sendReminder runs it under a 10s deadline and re-reads bookings.status afterwards to catch a cancellation during the lookup.
• Handler check — new Handler.ReminderAllowed loads the row where booking_hosts.user_id = bookings.host_id with a non-empty external_event_id (primary host only) and returns deliver when no such row exists.
• Provider capability — calendar.EventCancellationReader plus Service.EventCancelled, routed through the same providerForEvent path as updates/cancels. Providers without the capability (Microsoft, CalDAV) return (false, nil), preserving delivery.
• Google read — gcal.Client.EventCancelled GETs .../events/{id}?fields=status via DestinationClient, using the recorded calendar id when present. Only status:"cancelled" suppresses; confirmed/tentative deliver; everything else errors.
• Tests + docs — gcal status matrix, calendar routing, worker+handler integration, and an ARCHITECTURE §12 note.

Verified the load-bearing Google contract independently: a retained cancelled event returns HTTP 200 with status:"cancelled" from events.get, so suppression works in the normal window (Google purges cancelled events after ~30 days, after which the lookup degrades to the documented fail-closed error).

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash ｜ 𝕏}

✅ No new issues found.

Reviewed changes

Reviewed the delta since the prior pullfrog review (3ede0fb), which addresses the hot-reload concern raised there.

• Google-only service reload — new Handler.setGoogleCalendar builds a fresh calendar.Service, preserving the old non-Google primary plus every other registered provider and either replacing or removing only google. PatchGoogleSettings now routes both save and clear through it instead of SetCalendar(nil) / a gcal-only rebuild.
• Snapshot safety — the replacement is published under calMu while reading the old snapshot, so the previous provider map is never mutated and in-flight operations keep resolving on it.
• Regression tests — calendar_reload_test.go covers primary/snapshot preservation; google_calendar_reload_test.go drives the real settings handler then the real reminder worker and asserts Microsoft/CalDAV reminders still send after both credential save and clear, plus continued refusal to send an unverifiable Google reminder.

Verified the prior concern is closed: clearing or saving Google credentials no longer drops Microsoft/CalDAV registrations, so those bookings' reminders still deliver. go test for the touched packages and go vet pass at fc5d5b5.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash ｜ 𝕏}

Verified the bug on main (sendReminder only checks local status) and the fix placement is right: worker as single funnel, Handler.ReminderAllowed as owner, providerForEvent routing reuse, race re-check present. Tests are good. Three items before merge:

1. Run CI on the branch. Only cla+pullfrog exist here; the full-suite claim is unconfirmed. Needs a real build + go test run.
2. Decide fail-closed vs fail-open for transient lookup errors. A short Google outage at reminder time currently burns the job and permanently deletes reminders for live meetings. Either distinguish transient errors from definitive cancellation, or justify fail-closed explicitly in the PR.
3. File a follow-up for Microsoft/CalDAV parity — same bug still exists there; an ARCHITECTURE note alone loses track of it.

Minor: EventCancelled hard-errors on unregistered stamped providers while update/cancel paths fall through — intentional, but worth a code comment.