Add tenant-scoped solution ICS export

[tomqwu]

Summary:

• replace the solution ICS 501 response with a real calendar download
• preserve org, person, and team scopes before serialization
• add real-JWT authorization and cross-tenant privacy coverage
• synchronize current docs, OpenAPI snapshot, and generated Dart client references
• supersede the stale draft implementation in Sprint 4 follow-up — implement ICS format for /solutions/{id}/export #251

Changed files:

• api/routers/solutions.py: render tenant-scoped ICS events, assignees, roles, timezone, and owned locations
• tests/api/test_scheduling_tenant_boundaries.py: parse calendars and verify auth, scope, and tenant isolation
• tests/contract/openapi.snapshot.json and mobile/api_client/: refresh the documented contract deterministically
• docs/API_AUTHORIZATION.md and docs/ROADMAP.md: replace the obsolete unsupported-ICS statement

Validation for exact head 458d141 against base a591b41:

• make test-all: 1,985 passed, 21 skipped, 0 failed, 0 errors
• local report: test-artifacts/local-validation/20260915T180358.079186Z-42096-cc464a2d/report.json
• make test-mobile: 65 passed
• make test-mobile-generated: 692 passed; 48 known non-fatal generator warnings
• make mobile-codegen-check: deterministic and matches the canonical snapshot
• poetry run black --check api tests: passed
• poetry run ruff check api tests: passed
• make test-docs: 188 manual and 138 generated documents validated
• git diff --check and staged credential-value scan: passed
• local self-review: no blocking findings
• targeted mypy: 54 pre-existing errors remain in api/routers/solutions.py; this change introduced none and reduced the prior count by one

Follow-ups:

• production calendar-client polling remains release acceptance under P2: Run production release acceptance after business flows are accepted #271
• no live providers, hosted CI tests, hosted AI review, or deployment were used
• the source branch is intentionally retained