fix: security and calendar-sync hardening sweep

[jaspermayone]

Remediates the findings from a full-codebase review, in severity order. All specs pass (25, up from 7); rubocop, brakeman, and zeitwerk clean.

Critical

• Onboard account takeover — /api/user/onboard accepted a raw email and minted a non-expiring JWT for any existing account. It now requires a Google access token, verifies it with Google via GoogleTokenVerifier (audience-checked), derives the email from the verified token, enforces @wit.edu, and issues a 14-day, always-expiring JWT. Requires the matching extension change (see below).
• Calendar-event orphaning — re-scraping one student's schedule ran destroy_all on shared meeting times, orphaning every other enrolled student's tracked Google events (and spawning duplicates). Now reconciles by content key (deletes only stale rows, only when the scrape produced data) and deletes the remote Google event when a tracking row is destroyed.

High

• Removed Devise :registerable + signup route (bypassed the @wit.edu gate).
• rack-attack now verifies the JWT signature before trusting user_id for the admin safelist / throttle bucket.
• RRULE UNTIL computed in local (Eastern) zone so evening classes keep their final occurrence.
• Creation-triggered sync routed through the concurrency-limited job; create_event_in_calendar rescues RecordNotUnique and drops the duplicate remote event.
• catalog:refresh pre-flights the scrape and wraps delete+import+restore in a transaction; finals:reset protects current/future terms and dry-runs by default.
• Preload rooms/building on the schedule endpoint (N+1).

Medium

• tbd_room? string compare; course-destroy sync users captured before the enrollment cascade; room changes flagged via the join model; implemented the template disallowed-tag check; IDOR ownership check on gcal-event preference reads; university-events N+1; unique indexes + validations for the four has_one relations (migration includes conservative de-dup).

⚠️ Migration

EnforceHasOneUniqueness de-duplicates existing rows (keeping the earliest) before adding unique indexes, using raw SQL to avoid firing GoogleCalendar's remote-delete callback. Review the de-dup against production data before deploying.

Coordinated extension PR

Onboarding now expects a Google token instead of an email — see the calendar-extension branch jaspermayone/onboard-google-token-auth. Merge together. The extension's OAuth client ID must be added to the backend GOOGLE_OAUTH_CLIENT_IDS env (comma-separated; GoogleTokenVerifier also trusts the web client).