fix: allow worker outbound provider access

compose.yaml

@@ -116,6 +116,10 @@ services:
         condition: service_healthy
     networks:
       - data
+      - egress
+    dns:
+      - 1.1.1.1
+      - 8.8.8.8
     healthcheck:
       test: ["CMD-SHELL", "kill -0 1"]
       interval: 10s
@@ -188,9 +192,35 @@ services:
       - data
     profiles: ["tools"]
 
+  calendar:
+    <<: *backend-runtime
+    entrypoint: ["/app/calendar"]
+    command:
+      - -action
+      - bootstrap
+      - -file
+      - /calendar/reviewed.json
+      - -current-jalali-year
+      - "${CALENDAR_CURRENT_JALALI_YEAR:-0}"
+      - -reviewer
+      - "${CALENDAR_REVIEWER:-}"
+      - -actor
+      - "${CALENDAR_OPERATOR:-}"
+    restart: "no"
+    depends_on:
+      postgres:
+        condition: service_healthy
+    volumes:
+      - ${CALENDAR_FILE:-/srv/zarinpal-data/reviewed-calendar.json}:/calendar/reviewed.json:ro
+    networks:
+      - data
+    profiles: ["tools"]
+
 networks:
   data:
     internal: true
+  egress:
+    driver: bridge
   caddy_proxy:
     external: true
     name: ${CADDY_NETWORK:-caddy_proxy}