docs: MS Graph calendar commands/events + fix stale CalendarSource trait signature (T8.9, M4.4)

docs/03-data-model.md

@@ -339,6 +339,10 @@ segment (the M1 grounding invariant, asserted by the golden-transcript test).
     "expose_recordings": false, // never serve .wav unless explicitly true (FR-MCP-3)
   },
   "privacy": { "encrypt_at_rest": false },
+  // Optional MS Graph calendar source (M4.4, T8.9, FR-CAL-6). Opt-in, explicit consent via OAuth
+  // PKCE — OFF by default. `credential_ref` points into the OS credential store; the token itself
+  // is never written here (same invariant as sync credentials, FR-SYNC-6).
+  "calendar": { "graph_enabled": false, "graph_credential_ref": null },
 }
 ```