fix(installer): delete provider secrets before retirement

src/govoplan_calendar/backend/service.py

@@ -1655,6 +1655,30 @@ def _provider_secret_is_absent(provider: Any, provider_ref: str) -> bool:
         return False
 
 
+def delete_calendar_credentials_for_retirement(session: Session) -> int:
+    """Delete all Calendar-owned secrets before destructive module retirement.
+
+    This includes pre-hardening soft-deleted rows whose provider references or
+    ciphertext were retained. Provider deletion is intentionally fail-closed;
+    the caller must not drop Calendar tables if any external deletion fails.
+    """
+
+    credentials = session.query(CalendarSyncCredential).order_by(CalendarSyncCredential.id.asc()).all()
+    deleted = 0
+    for credential in credentials:
+        metadata = credential.metadata_ if isinstance(credential.metadata_, dict) else {}
+        source_id = metadata.get("source_id")
+        if _delete_calendar_owned_credential(
+            session,
+            credential=credential,
+            source_id=str(source_id) if source_id else None,
+            deletion_reason="module_data_retired",
+        ):
+            deleted += 1
+    session.flush()
+    return deleted
+
+
 def resolve_caldav_secret(
     session: Session,
     *,