Add Google Calendar as a native Pi custom tool

pi-claude-code-provider fences off Claude Code's MCP servers by design,
so managed MCPs like Google Calendar can't reach the bot through that
provider. Implement calendar access as a first-class Pi tool instead —
it lives alongside `schedule` and calls Google Calendar API v3 directly
with a subscription-free refresh-token grant.

Config: three new optional env vars (GOOGLE_CLIENT_ID,
GOOGLE_CLIENT_SECRET, GOOGLE_REFRESH_TOKEN) — set all three to enable
the tool, leave all three blank to disable. Partial config raises a
ConfigError at startup so mis-set env is caught early.

Tool: list / create / update / delete on any calendar (default
'primary'). Access tokens are cached until expiry and refreshed on
demand from the long-lived refresh token. Invalid_grant surfaces a
clear "re-run device flow" error.

.env.example

@@ -14,3 +14,10 @@ SECRETARY_TIMEZONE=
 SECRETARY_SHELL=
 LOG_LEVEL=info
 # PI_CODING_AGENT_DIR=  (Pi's own override for ~/.pi/agent, mainly for Docker)
+
+# Google Calendar tool: all three or none. Bootstrap the refresh token with an
+# OAuth device flow against a Google Cloud OAuth client (type: TVs and Limited
+# Input devices) — see docs/. Scope needed: https://www.googleapis.com/auth/calendar
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+GOOGLE_REFRESH_TOKEN=