feat(sync): add Microsoft account connect CLI

nocal account connect microsoft runs the PKCE browser flow, reads /me,
upserts the deterministic account row, and persists tokens to Secret
Service as the final connected-state gate. Account IDs are hashed from
the remote subject so reconnect is idempotent, and a secret-store
failure leaves the same coherent state as a disconnect. Ships a
placeholder client ID with NOCAL_MICROSOFT_CLIENT_ID override until a
real Entra registration exists.

docs/ARCHITECTURE.md

@@ -288,6 +288,16 @@ This design avoids beta and undocumented per-calendar delta routes. Its
 tradeoff is bandwidth: every secondary window is fetched completely on each
 refresh, while the primary calendar remains incremental.
 
-There is no account UI or CLI orchestration and no live Microsoft credential
-integration yet; tests use injected transports and credentials. Remote writes
-remain out of scope. Account setup and orchestration are next.
+Account setup now has a CLI entry point, `nocal account connect microsoft`.
+It composes the desktop OAuth adapters, libcurl transport, token parsing, one
+`/me` identity read, the sync cache, and the Secret Service store in a fixed
+order: the account row is upserted first, and the versioned secret payload is
+stored last as the connected-state gate. A secret-store failure therefore
+leaves the same coherent state as a disconnect, and reconnecting is idempotent
+because the local account id is a deterministic hash of the remote subject.
+This build carries a placeholder client ID; a real Entra registration is
+supplied through the `NOCAL_MICROSOFT_CLIENT_ID` environment variable (a
+public client ID, never a secret). There is no account TUI and no sync
+orchestration yet; tests use injected transports and credentials. Remote
+writes remain out of scope. Generic `SyncProvider` integration and observable
+sync status are next.

docs/ROADMAP.md

@@ -105,10 +105,23 @@ Completed provider-boundary contracts and token broker:
   `AccountDisconnected` for re-authentication
 - Credential material never appears in exception messages
 
+Completed account setup (CLI):
+
+- `nocal account connect microsoft` runs the PKCE browser flow, reads `/me`,
+  upserts the deterministic account row, and persists tokens to Secret
+  Service as the final connected-state gate
+- Deterministic local account IDs hashed from the remote subject make
+  reconnect idempotent; a secret-store failure leaves the same coherent state
+  as a disconnect
+- Placeholder client ID with `NOCAL_MICROSOFT_CLIENT_ID` override until a
+  real Entra mobile/desktop registration exists
+- Deterministic failure-path tests: rejection, token errors, identity
+  failure, storage failure, and credential redaction in error messages
+
 Next provider-boundary slices:
 
-- Account setup and CLI/TUI orchestration with live credential integration
-- Generic `SyncProvider` integration and observable sync status
+- TUI account orchestration and generic `SyncProvider` integration with
+  observable sync status
 
 ## 0.3 — CalDAV
 
@@ -125,9 +138,10 @@ Next provider-boundary slices:
 
 The Graph read boundary uses stable v1 delta for the primary calendar and
 complete stable-v1 calendar views for secondary calendars; it deliberately
-avoids beta and undocumented per-calendar delta routes. No account UI/CLI
-orchestration or live Microsoft credential integration exists yet, and remote
-writes remain out of scope.
+avoids beta and undocumented per-calendar delta routes. Account connect exists
+as a CLI command with live credential integration through Secret Service, but
+there is no account TUI or sync orchestration yet, and remote writes remain
+out of scope.
 
 ## 1.0 — distribution quality