Scheduling: per-firm Cal.com accounts

Decision 2026-07-04; core built same day: tenant_integration_credentials (AES-256-GCM-sealed), per-tenant adapter factory with env fallback, tenant-scoped webhook route with cross-tenant apply fence, connect/disconnect UI with a pre-persist vendor probe. 5-case integration test green.

Remaining to close: send the host to Cal.com on event-type create (today the host is never sent — the root cross-tenant leakage finding), tenant-scoped slugs (slugify collisions across firms), connect-flow E2E, and one live per-tenant webhook capture. Also flagged: reschedule UID drift (mirror keeps the original Cal.com UID after reschedule, so a later cancel under the new UID may not resolve).