Add CalDAV outbox recovery UI

docs/CALENDAR_INTEGRATION_CONCEPT.md

@@ -89,14 +89,23 @@ per-source throughput for a simple ordering guarantee: a stale inbound report
 cannot land after a newer outbound result, and queued leases do not expire while
 waiting behind another network request for the same source.
 
-Operators can list, dispatch, retry, reconcile, and discard tenant operations
-through the `/calendar/caldav/outbox` administration endpoints. Terminal ETag
+Operators open **Outbound changes** from a synchronized calendar's settings to
+inspect a bounded queue and use only the retry, reconcile, or discard actions
+that are valid for the latest resource generation. Dispatch and due-source
+routes are worker-only and reject interactive sessions even when the account is
+an administrator. Terminal ETag
 conflicts and exhausted retries remain the current local desired state and
 shield that resource from inbound overwrite until explicitly resolved.
 Discarding is the administrator's accept-remote transition: it is allowed only
 for the latest generation, atomically cancels its unresolved predecessor chain,
 marks the event projection as discarded, clears the sync token, and schedules a
 full inbound reconciliation so an unchanged remote object is not missed.
+The UI requires a separate destructive confirmation and explains that accepting
+remote may lose the unresolved local desired state. Disabled and inbound-only
+sources still permit discard when the retained source belongs to the tenant,
+but they cannot be retried or reconciled until made writable again. Missing
+sources, active worker leases, stale generations, and already-resolved rows
+expose diagnostics instead of unsafe action buttons.
 
 Disabling outbound delivery or switching to inbound-only is rejected while
 unresolved desired state exists; retirement is the explicit exception and