Implement Open-Xchange calendar profiles

docs/CALENDAR_INTEGRATION_CONCEPT.md

@@ -32,11 +32,41 @@ The first standalone module provides:
   deterministic hrefs, conditional requests, expiring leases, bounded
   exponential retry, and semantic GET reconciliation after ambiguous outcomes
 - WebUI views: month, week, workweek, day, and continuous week-row scrolling
+- an Open-Xchange profile over the CalDAV transport, with explicit connector,
+  IDM/group-mapping, and resource-calendar references
 
 The implementation is not yet a full CalDAV network server. It is the internal
 calendar storage, recurrence, sync, availability, and UI foundation on which
-Open-Xchange integration, scheduling inbox/outbox behavior, and CalDAV server
-endpoints can be built.
+scheduling inbox/outbox behavior and CalDAV server endpoints can be built.
+
+## Open-Xchange profile
+
+Open-Xchange is an explicit external profile backed by Calendar's CalDAV
+engine. A profile therefore receives the same bounded discovery, VEVENT
+round-trip, RRULE/RDATE/EXDATE and detached-exception handling, sync-token/ctag
+tracking, per-resource ETag conflict detection, and durable two-way outbox as a
+generic CalDAV source. Calendar's availability capability reads the resulting
+projection, so free/busy and collision checks use the same recurrence-aware
+event set. Availability is current as of the source's visible last successful
+sync; GovOPlaN does not claim live Open-Xchange state while a source is stale.
+
+The source metadata retains three optional, non-secret bindings:
+
+- `connector_profile_ref` links the endpoint to a Connectors-owned inventory or
+  deployment profile.
+- `identity_mapping_ref` links attendee/group identifiers to an IDM- or
+  Access-governed mapping without importing either module.
+- `resource_calendar_ref` identifies an Open-Xchange room/equipment calendar;
+  the corresponding Calendar collection is owned as a `resource`.
+
+The `calendar.externalProfiles` capability lets an optional connector configure
+the same profile through a Core contract. Direct Calendar setup remains
+available when Connectors is absent. The connector never supplies a Calendar
+event model and the references never contain credentials. Open-Xchange
+credentials remain a reusable credential-envelope reference or a
+Calendar-owned encrypted credential. The WebUI exposes Open-Xchange as a source
+type and reuses CalDAV discovery; deployments must enter a DAV endpoint that
+resolves to the intended collection.
 
 ## Outbound delivery operations