calendar: read-only MCP over the Google calendars shared with the service account, at /mcp (Bearer <agent token>).