feat: add durable provider cache

Add a private provider-neutral SQLite WAL cache with transactional migrations, retained raw payloads and tombstones, per-window opaque checkpoints, and reserved outbox/conflict tables.

Verify migrations, permissions, identity invariants, concurrent access, atomic pull-page rollback, and future-schema rejection with deterministic tests. No OAuth, networking, secrets, or Graph synchronization is included yet.

README.md

@@ -7,7 +7,9 @@ inherits its colors from your terminal theme.
 This repository currently contains the first local-calendar vertical slice:
 date/domain logic, guarded atomic iCalendar persistence, add/edit/delete forms,
 a responsive ANSI terminal UI with month and agenda views, explicit safe
-calendar import/export, tests, and Linux launch integration. See
+calendar import/export, tests, and Linux launch integration. A provider-neutral
+SQLite cache now provides the durable boundary required before
+Office 365 or any other remote provider is connected. See
 [the product specification](docs/PRODUCT.md),
 [architecture](docs/ARCHITECTURE.md), and [roadmap](docs/ROADMAP.md).
 
@@ -105,3 +107,22 @@ backup itself is kept so recovery can be repeated.
 
 For a popup calendar binding and version-specific Hyprland rules, see
 [Hyprland integration](docs/HYPRLAND.md).
+
+## Remote-provider foundation
+
+The remote-provider foundation is a private local SQLite database in WAL mode,
+separate from the interactive `.ics` file workflow. Its schema is migrated by
+version in all-or-nothing transactions. It preserves raw provider payloads,
+inactive calendars, and tombstoned events so synchronization cannot silently
+discard data that the current application does not understand. Each opaque
+provider cursor is scoped to a calendar and synchronization window and is
+committed atomically with the pulled page it represents. Normalized event
+instances provide immutable snapshot input, while transactional outbox and
+conflict records are reserved for later write synchronization.
+
+This is a persistence prerequisite, not working Office 365 integration. Nocal
+does not yet perform OAuth, make Graph requests, or synchronize a remote
+calendar. OAuth tokens and other secrets will never be stored in SQLite; they
+belong in the Freedesktop Secret Service. The next implementation step is an
+injectable HTTP boundary with PKCE authentication and deterministic fake
+transports, followed by read-only Microsoft Graph delta synchronization.