feat: add durable provider cache

Add a private provider-neutral SQLite WAL cache with transactional migrations, retained raw payloads and tombstones, per-window opaque checkpoints, and reserved outbox/conflict tables.

Verify migrations, permissions, identity invariants, concurrent access, atomic pull-page rollback, and future-schema rejection with deterministic tests. No OAuth, networking, secrets, or Graph synchronization is included yet.

docs/ROADMAP.md

@@ -24,12 +24,22 @@
 - Embedded VTIMEZONE support
 - Screen-reader-friendly linear view and full Unicode display-width handling
 
-## 0.2 — durable cache and provider boundary
+## 0.2 — durable cache and provider boundary — in progress
 
-- SQLite WAL cache and migration framework
-- Background job queue, immutable UI snapshots, observable sync status
-- Secret Service credentials and OAuth callback helper
-- Generic `SyncProvider` contract plus a fake provider test suite
+Completed cache foundation:
+
+- Provider-neutral SQLite WAL cache in a private local file
+- Versioned, all-or-nothing schema migrations
+- Raw provider payload retention, inactive calendars, and event tombstones
+- Per-calendar/window opaque cursors committed atomically with pulled pages
+- Normalized event instances for immutable snapshots
+- Reserved transactional outbox and conflict records for later remote writes
+
+Next provider-boundary slices:
+
+- Injectable HTTP, PKCE authentication, and deterministic fake transports
+- Secret Service credentials; OAuth secrets are never stored in SQLite
+- Generic `SyncProvider` contract and observable sync status
 
 ## 0.3 — CalDAV
 
@@ -40,9 +50,15 @@
 ## 0.4 — hosted providers
 
 - Google Calendar adapter with incremental synchronization
-- Microsoft 365 adapter over Microsoft Graph delta queries
+- Microsoft 365 read-only discovery and Graph delta synchronization, followed by
+  ETag-aware remote writes after the conflict boundary is proven
 - Account/calendar management UI and per-calendar ANSI identity
 
+The current cache work is only the prerequisite durable boundary. No network,
+OAuth, or Graph synchronization is implemented in that phase. After the cache
+passes its verification gates, the immediate sequence is injectable HTTP plus
+PKCE and fake transports, then read-only Microsoft Graph delta synchronization.
+
 ## 1.0 — distribution quality
 
 - Stable configuration/data format and documented recovery procedures