feat(calendar): maintenance window + schedule_type special slots

## What this adds

1. **Maintenance window on ScheduleType**
   - New columns: maintenance_from / maintenance_to (UTC hours, 0-23)
   - Invariant: window is exactly 1 hour (validated in pydantic;
     maintenance_to must equal (maintenance_from + 1) % 24)
   - Default applied via additive migration: 8:00-9:00 UTC for existing
     rows so deployments don't crash on first boot

2. **ScheduleTypeSpecialSlot** — admin-managed slot template
   - New table schedule_type_special_slots
   - Admin (schedule_type.manage) CRUD via
     /schedule-types/{id}/special-slots
   - Fields: name, description, minute_in_window (0-59 inside the
     parent maintenance window), estimated_duration, priority,
     event_data (JSON merged into materialised slot), is_active
   - Unique constraint (schedule_type_id, name) — name is the stable
     human-readable identifier per cohort

3. **Per-agent materialisation**
   - New service app/services/special_slot_materialiser.py
   - GET /calendar/sync calls materialise_special_slots_for_claw
     (idempotent, one row per agent per template per date)
   - GET /calendar/day calls materialise_special_slots_for_user
   - Materialised rows are slot_type=system, event_type=system_event,
     is_admin_locked=true, special_slot_id pointing back to template
   - Plugin's runSync picks them up like any other due slot via the
     normal real-slots query path

4. **Admin-locked enforcement**
   - New TimeSlot columns: is_admin_locked, special_slot_id (FK to
     schedule_type_special_slots, ON DELETE SET NULL)
   - PATCH /calendar/slots/{id}: refuses any edit on admin-locked
     slots (423)
   - POST /calendar/slots/{id}/cancel: refuses cancel on admin-locked
     (423)
   - PATCH /calendar/slots/{id}/agent-update: admin-locked accept only
     ongoing/paused/finished/aborted statuses (423 on other transitions)

5. **Maintenance-window guard on slot creation**
   - POST /calendar/slots: rejects slot_type=system outright (only
     materialiser may create system slots) and rejects any non-system
     slot whose [scheduled_at, +duration] intersects the calling
     user's schedule_type maintenance window (422). Handles 23->0 wrap

6. **Schema response**
   - TimeSlotResponse / CalendarSlotItem now include is_admin_locked
     and special_slot_id so clients can render the lock indicator and
     trace back to the template

## Migration

Additive only — no destructive changes. Lives in _migrate_schema()
in app/main.py; the new schedule_type_special_slots table is created
by Base.metadata.create_all() on first boot.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/api/routers/schedule_type.py

@@ -9,7 +9,7 @@ from sqlalchemy.orm import Session
 from typing import List
 
 from app.core.config import get_db
-from app.api.deps import get_current_user_or_apikey
+from app.api.deps import get_current_user
 from app.models.models import User
 from app.models.agent import Agent
 from app.models.schedule_type import ScheduleType
@@ -68,7 +68,7 @@ def _require_schedule_manage(db: Session, user: User) -> User:
 )
 def list_schedule_types(
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user_or_apikey),
+    current_user: User = Depends(get_current_user),
 ):
     _require_schedule_read(db, current_user)
     return db.query(ScheduleType).all()
@@ -82,7 +82,7 @@ def list_schedule_types(
 def create_schedule_type(
     payload: ScheduleTypeCreate,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user_or_apikey),
+    current_user: User = Depends(get_current_user),
 ):
     _require_schedule_manage(db, current_user)
 
@@ -112,7 +112,7 @@ def update_schedule_type(
     schedule_type_id: int,
     payload: ScheduleTypeUpdate,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user_or_apikey),
+    current_user: User = Depends(get_current_user),
 ):
     _require_schedule_manage(db, current_user)
 
@@ -135,7 +135,7 @@ def update_schedule_type(
 def delete_schedule_type(
     schedule_type_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user_or_apikey),
+    current_user: User = Depends(get_current_user),
 ):
     _require_schedule_manage(db, current_user)
 
@@ -192,7 +192,7 @@ def assign_schedule_type(
     agent_id: str,
     payload: AgentScheduleTypeAssign,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user_or_apikey),
+    current_user: User = Depends(get_current_user),
 ):
     _require_schedule_manage(db, current_user)