Add nidusctl admin CLI for managing calendar/address-book shares

- tools/nidusctl: subcommands `calendar {share,unshare,shares}` and
  `addressbook {share,unshare,shares}`, thin wrapper around internal/db.
  Warns (non-fatal) if owner/user isn't in config.yaml.
- internal/db: add SharesOfAddressBook (owner-perspective query, mirrors
  SharesOfCalendar) needed by the CLI.
- internal/db: db.Open now creates the parent data directory itself, so
  the CLI works standalone without requiring the server to have run first.
- Update Makefile (build bin/nidusctl, new 'nidusctl' target), README and
  copilot-instructions with usage docs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

README.md

@@ -146,11 +146,24 @@ grantee's own home-set alongside their own calendars — no separate account
 or extra client configuration needed.
 
 Sharing grants are stored in a small SQLite database at
-`<data_dir>/nidus.db` (not in `config.yaml`). There's no CLI or web UI for
-managing shares yet — the initial backend groundwork lives in
-`internal/db` (see `ShareCalendar`, `UnshareCalendar`,
-`ShareAddressBook`, `UnshareAddressBook`), which a future admin CLI or web
-UI will call into.
+`<data_dir>/nidus.db` (not in `config.yaml`) and managed with the
+`nidusctl` CLI (there's no web UI yet):
+
+```bash
+# Give bob write access to alice's "work" calendar
+go run ./tools/nidusctl -config config.yaml calendar share alice work bob write
+
+# List everyone alice's "work" calendar is shared with
+go run ./tools/nidusctl -config config.yaml calendar shares alice work
+
+# Revoke access
+go run ./tools/nidusctl -config config.yaml calendar unshare alice work bob
+
+# Address books work the same way, using "addressbook" instead of "calendar"
+go run ./tools/nidusctl -config config.yaml addressbook share alice contacts bob read
+```
+
+Or via `make`: `make nidusctl ARGS="calendar share alice work bob write"`.
 
 A calendar that `alice` shares with `bob` appears in bob's calendar
 home-set as `/cal/home/alice~work/` (i.e. `<owner>~<calendar name>`) — the
@@ -237,6 +250,7 @@ caldav-server/
 │   ├── store/           # filesystem storage layer
 │   └── webdav/          # WebDAV file handler
 ├── tools/hashpwd/       # bcrypt password hasher CLI
+├── tools/nidusctl/      # sharing-grant admin CLI
 ├── config.example.yaml  # sample configuration (copy to config.yaml)
 ├── Dockerfile
 ├── docker-compose.yaml