Add nidusctl admin CLI for managing calendar/address-book shares

- tools/nidusctl: subcommands `calendar {share,unshare,shares}` and
  `addressbook {share,unshare,shares}`, thin wrapper around internal/db.
  Warns (non-fatal) if owner/user isn't in config.yaml.
- internal/db: add SharesOfAddressBook (owner-perspective query, mirrors
  SharesOfCalendar) needed by the CLI.
- internal/db: db.Open now creates the parent data directory itself, so
  the CLI works standalone without requiring the server to have run first.
- Update Makefile (build bin/nidusctl, new 'nidusctl' target), README and
  copilot-instructions with usage docs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/copilot-instructions.md

@@ -108,6 +108,14 @@ Test files: `internal/store/store_test.go`, `internal/webdav/handler_test.go`,
   reused, not per-request, or LOCK/UNLOCK state resets on every call.
 - `tools/hashpwd` — standalone CLI (`go run ./tools/hashpwd <password>`) to
   generate bcrypt hashes for `config.yaml`.
+- `tools/nidusctl` — standalone admin CLI (`go run ./tools/nidusctl
+  -config config.yaml <calendar|addressbook> <share|unshare|shares> ...`)
+  for managing `internal/db` sharing grants. It's a thin argv-parsing
+  wrapper around `db.DB`'s methods — no server interaction, no daemon, no
+  RPC; it just opens the same SQLite file the running server uses. Since
+  the caldav/carddav backends query the shares tables on every request
+  (no caching), changes take effect immediately without restarting the
+  server.
 
 ## Conventions