Add nidusctl admin CLI for managing calendar/address-book shares

- tools/nidusctl: subcommands `calendar {share,unshare,shares}` and
  `addressbook {share,unshare,shares}`, thin wrapper around internal/db.
  Warns (non-fatal) if owner/user isn't in config.yaml.
- internal/db: add SharesOfAddressBook (owner-perspective query, mirrors
  SharesOfCalendar) needed by the CLI.
- internal/db: db.Open now creates the parent data directory itself, so
  the CLI works standalone without requiring the server to have run first.
- Update Makefile (build bin/nidusctl, new 'nidusctl' target), README and
  copilot-instructions with usage docs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Makefile

@@ -1,8 +1,9 @@
-.PHONY: build run test tidy lint docker hash-password
+.PHONY: build run test tidy lint docker hash-password nidusctl
 
 ## build: compile the binary
 build:
 	go build -o bin/davserver ./cmd/server
+	go build -o bin/nidusctl ./tools/nidusctl
 
 ## run: run the server locally
 run: build
@@ -32,3 +33,8 @@ compose:
 ## Usage: make hash-password PWD=mysecret
 hash-password:
 	@go run -v ./tools/hashpwd $(PWD)
+
+## nidusctl: build and run the sharing-grant admin CLI
+## Usage: make nidusctl ARGS="calendar share alice work bob write"
+nidusctl: build
+	./bin/nidusctl -config config.yaml $(ARGS)