feat(webui): complete calendar quick access

tests/test_interface_documentation_contract.py

@@ -54,6 +54,26 @@ class CalendarInterfaceDocumentationContractTests(unittest.TestCase):
         self.assertIn("calendar.outbox", recovery.metadata["help_contexts"])
         self.assertIn("reconcile_outbox", recovery.metadata["consequence_classes"])
 
+        quick_tool = get_manifest().frontend.quick_access_tools[0]
+        self.assertEqual(("calendar.event",), quick_tool.returned_reference_kinds)
+        self.assertEqual("calendar.quick_access.agenda", quick_tool.help_context_id)
+        self.assertEqual("/calendar", quick_tool.full_page_path)
+
+    def test_quick_access_is_bounded_temporal_and_owner_launched(self) -> None:
+        quick_access = (
+            REPO_ROOT / "webui/src/features/calendar/CalendarQuickAccess.tsx"
+        ).read_text(encoding="utf-8")
+        page = (
+            REPO_ROOT / "webui/src/features/calendar/CalendarPage.tsx"
+        ).read_text(encoding="utf-8")
+
+        self.assertIn("const AGENDA_LIMIT = 7", quick_access)
+        self.assertIn("launchContext.temporalContext", quick_access)
+        self.assertIn("limit: AGENDA_LIMIT", quick_access)
+        self.assertIn('kind: "event"', quick_access)
+        self.assertIn("quickAccessLaunchState(launchContext)", quick_access)
+        self.assertIn('parameters.get("quickAction") !== "create-event"', page)
+
     def test_webui_uses_shared_help_guard_and_confirmation_components(self) -> None:
         event_dialog = (REPO_ROOT / "webui/src/features/calendar/CalendarEventDialog.tsx").read_text(encoding="utf-8")
         collection_dialog = (REPO_ROOT / "webui/src/features/calendar/CalendarCollectionDialogs.tsx").read_text(encoding="utf-8")

tests/test_service.py

@@ -5,8 +5,20 @@ from datetime import datetime, timedelta, timezone
 from types import SimpleNamespace
 from unittest.mock import patch
 
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session
+
+from govoplan_access.backend.db.models import Account, User
+from govoplan_calendar.backend.db.models import CalendarCollection, CalendarEvent
 from govoplan_calendar.backend.schemas import CalendarCollectionDeleteRequest, CalendarEventResponse
-from govoplan_calendar.backend.service import calendar_is_visible_to_principal, delete_calendar, event_response
+from govoplan_calendar.backend.service import (
+    calendar_is_visible_to_principal,
+    delete_calendar,
+    event_response,
+    list_event_occurrences,
+    list_events,
+)
+from govoplan_core.db.base import Base
 
 
 class FakeSession:
@@ -108,6 +120,81 @@ class CalendarVisibilityTests(unittest.TestCase):
             )
         )
 
+    def test_event_queries_apply_visible_calendar_fence_and_limit(self) -> None:
+        engine = create_engine("sqlite://")
+        Base.metadata.create_all(
+            engine,
+            tables=(
+                Account.__table__,
+                User.__table__,
+                CalendarCollection.__table__,
+                CalendarEvent.__table__,
+            ),
+        )
+        session = Session(engine)
+        start = datetime(2026, 8, 19, 9, tzinfo=timezone.utc)
+        try:
+            session.add_all(
+                (
+                    CalendarCollection(
+                        id="visible-calendar",
+                        tenant_id="tenant-1",
+                        slug="visible",
+                        name="Visible",
+                        visibility="tenant",
+                    ),
+                    CalendarCollection(
+                        id="private-calendar",
+                        tenant_id="tenant-1",
+                        slug="private",
+                        name="Private",
+                        visibility="private",
+                        owner_type="user",
+                        owner_id="other-user",
+                    ),
+                    CalendarEvent(
+                        id="visible-event",
+                        tenant_id="tenant-1",
+                        calendar_id="visible-calendar",
+                        uid="visible@example.test",
+                        summary="Visible event",
+                        start_at=start,
+                        end_at=start + timedelta(hours=1),
+                    ),
+                    CalendarEvent(
+                        id="private-event",
+                        tenant_id="tenant-1",
+                        calendar_id="private-calendar",
+                        uid="private@example.test",
+                        summary="Private event",
+                        start_at=start + timedelta(hours=2),
+                        end_at=start + timedelta(hours=3),
+                    ),
+                )
+            )
+            session.commit()
+
+            events = list_events(
+                session,
+                tenant_id="tenant-1",
+                visible_calendar_ids=("visible-calendar",),
+                limit=1,
+            )
+            occurrences = list_event_occurrences(
+                session,
+                tenant_id="tenant-1",
+                start_at=start - timedelta(hours=1),
+                end_at=start + timedelta(days=1),
+                visible_calendar_ids=("visible-calendar",),
+                limit=1,
+            )
+
+            self.assertEqual(["visible-event"], [event.id for event in events])
+            self.assertEqual(["visible-event"], [event["id"] for event in occurrences])
+        finally:
+            session.close()
+            engine.dispose()
+
     def test_private_calendar_is_hidden_from_other_readers_but_visible_to_admin(self) -> None:
         calendar = self.calendar()
         self.assertFalse(