feat(go): IO layer behind interfaces (M4)

- io/attendance: CSV-over-public-URL client + Fake for adult/junior tabs
- io/drive: Drive v3 modifiedTime client + Fake
- io/sheets: Sheets v4 client (GetValues/AppendValues/BatchUpdateValues/
  WriteHeader/SortByDateColumn) + Fake with call-capture
- io/cache: Drive-modifiedTime-gated FileCache; two TTL knobs; atomic
  writes; generic Get[T]; Python-compatible JSON format; Flush()
- io/fio: Client interface backed by Fio REST API (apiClient) and HTML
  scraper (transparentClient); Fake; testdata fixtures
- membership/sources: NewSources wires attendance CSV + Sheets + cache
  into LoadAdults/LoadJuniors/LoadTransactions/LoadExceptions; Czech
  month parsing + merged-month maps
- banksync: SyncToSheets (SHA-256 dedup, optional sort) and
  InferPayments ([?] review prefix, dry-run) — tested with fakes
- cmd/fuj: sync and infer subcommands wired; fees and reconcile use
  real NewSources; go.mod gains google.golang.org/api + x/net
- gofumpt extra-rules applied across all packages; lint clean

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

go/internal/io/drive/client.go

@@ -0,0 +1,46 @@
+// Package drive provides a thin wrapper around the Google Drive v3 API,
+// used only to read modifiedTime for cache invalidation.
+package drive
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"google.golang.org/api/drive/v3"
+	"google.golang.org/api/option"
+)
+
+// Client wraps the Drive v3 API, scoped to read-only modifiedTime checks.
+type Client struct {
+	svc *drive.Service
+}
+
+// New builds a Client using a service-account credentials file.
+// timeout applies to each Drive API call.
+func New(ctx context.Context, credentialsPath string, timeout time.Duration) (*Client, error) {
+	hc := &http.Client{Timeout: timeout}
+	svc, err := drive.NewService(ctx,
+		option.WithCredentialsFile(credentialsPath), //nolint:staticcheck
+		option.WithScopes(drive.DriveReadonlyScope),
+		option.WithHTTPClient(hc),
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &Client{svc: svc}, nil
+}
+
+// ModifiedTime returns the RFC3339 modifiedTime for the given Drive file ID.
+// Returns ("", err) if the Drive API call fails.
+func (c *Client) ModifiedTime(ctx context.Context, fileID string) (string, error) {
+	meta, err := c.svc.Files.Get(fileID).
+		Fields("modifiedTime").
+		SupportsAllDrives(true).
+		Context(ctx).
+		Do()
+	if err != nil {
+		return "", err
+	}
+	return meta.ModifiedTime, nil
+}

go/internal/io/drive/fake.go

@@ -0,0 +1,18 @@
+package drive
+
+import "context"
+
+// Fake is an in-memory replacement for Client used in tests.
+type Fake struct {
+	// Times maps file ID → modifiedTime string returned by ModifiedTime.
+	Times map[string]string
+	// Err, if non-nil, is returned instead of looking up Times.
+	Err error
+}
+
+func (f *Fake) ModifiedTime(_ context.Context, fileID string) (string, error) {
+	if f.Err != nil {
+		return "", f.Err
+	}
+	return f.Times[fileID], nil
+}