feat(sync): add Microsoft Graph read adapter

Add strict /me identity, atomic paged calendar discovery, and resumable primary-calendar v1 delta synchronization through the durable provider cache. Keep opaque continuations on trusted Graph URLs and retain credentials only per operation.

Document that stable Graph v1 delta covers only the primary calendar; secondary calendars still require a v1 reconciliation or beta dependency decision.

Verified: 18/18 normal, 18/18 -Werror, and 18/18 ASan/UBSan tests.

docs/ROADMAP.md

@@ -70,11 +70,26 @@ Completed token/secret boundary:
 - OAuth secrets only in Secret Service, never SQLite, logs, CLI arguments, or
   environment variables
 
+Completed Microsoft Graph read phase:
+
+- Public desktop multitenant organizational/personal account support
+- Delegated `User.Read` for `/me` and `Calendars.Read` for calendars/events;
+  tenant policy may still require approval or block user consent
+- Per-operation access tokens with persistent tokens retained only by Secret
+  Service
+- Complete paged all-calendar discovery with atomic cache replacement and
+  deterministic local IDs
+- Immutable Graph event IDs, strict bounded parsing, and credential-safe errors
+- HTTPS `graph.microsoft.com`-only opaque continuation/delta links
+- Half-open UTC event windows and per-page event/tombstone/cursor transactions
+- Resumable primary-calendar v1 delta synchronization
+
 Next provider-boundary slices:
 
-- Microsoft `/me` identity and read-only calendar discovery
-- Read-only Graph delta synchronization using delegated `Calendars.Read`
-- Generic `SyncProvider` contract and observable sync status
+- Account setup and CLI/TUI orchestration with live credential integration
+- Choose secondary-calendar behavior: v1 full-window reconciliation with
+  deletion semantics, or an explicit beta-specific delta dependency
+- Generic `SyncProvider` integration and observable sync status
 
 ## 0.3 — CalDAV
 
@@ -89,11 +104,12 @@ Next provider-boundary slices:
   ETag-aware remote writes after the conflict boundary is proven
 - Account/calendar management UI and per-calendar ANSI identity
 
-The cache, generic HTTP/OAuth boundary, and concrete Linux adapters are
-prerequisites, not usable Microsoft 365 integration. The token/Secret
-Service phase still provides no Graph call, account UI, or usable account setup.
-After it passes verification, the immediate sequence is Microsoft `/me`,
-read-only calendar discovery, and Graph delta synchronization.
+The Graph read phase discovers all calendars but uses stable v1 delta only for
+the primary calendar; it deliberately avoids beta and undocumented
+per-calendar routes. No account UI/CLI orchestration or live Microsoft
+credential integration exists yet, and remote writes remain out of scope. Do
+not claim Outlook-equivalent coverage until the secondary-calendar strategy is
+chosen and verified.
 
 ## 1.0 — distribution quality