Move users, calendars, and address books from config.yaml into the database

BREAKING CHANGE: the users:/config-based collection setup is gone. All
user, calendar, and address-book data now lives in the SQLite DB
(internal/db) and is managed exclusively via nidusctl or the web UI.
Existing deployments must recreate their users after upgrading:
  nidusctl user create <username>
  nidusctl calendar create <username> <name>
  nidusctl addressbook create <username> <name>

- internal/db: new users, calendars, addressbooks tables with FK cascade
  delete; foreign_keys pragma enabled; internal/db/users.go implements
  full CRUD + bcrypt auth (CreateUser, VerifyPassword, ListUsers,
  CreateCalendar/AddressBook, etc).
- internal/config: removed Users/UserConfig entirely.
- internal/auth: Basic Auth now checks credentials via db.DB instead of
  cfg.Users.
- internal/caldav, internal/carddav: ListCalendars/ListAddressBooks and
  Create/Delete now backed by the DB.
- internal/web: login uses db.VerifyPassword; new resources.go adds
  create/delete handlers for calendars/address books at
  /web/resources/{calendar,addressbook}; dashboard gained create forms
  and per-card delete buttons (templ + htmx, no hyperscript).
- tools/nidusctl: new user create/delete/list/passwd commands (masked
  interactive password prompt via golang.org/x/term) plus create/delete/
  list subcommands for calendar/addressbook.
- cmd/server/main.go: pre-creates on-disk collections from the DB at
  startup instead of cfg.Users; warns when no users exist yet.
- Updated tests to seed data via the DB; added resources_test.go for the
  new web UI handlers.
- README.md and .github/copilot-instructions.md updated to document the
  new nidusctl commands and the DB-backed architecture.

Verified end-to-end against a live test server: nidusctl user/calendar/
addressbook create, DAV Basic Auth PROPFIND, web login, dashboard
rendering, and web UI create/delete of resources all confirmed working.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

README.md

@@ -30,38 +30,20 @@ A self-hosted **CalDAV**, **CardDAV**, and **WebDAV** server written in Go.
 go mod tidy
 ```
 
-### 2. Generate password hashes
-
-```bash
-go run ./tools/hashpwd mysecretpassword
-# Outputs: $2b$12$...
-```
-
-### 3. Create your `config.yaml`
+### 2. Create your `config.yaml`
 
 Copy the example config and edit it — `config.yaml` is git-ignored so your
-real credentials/domain never get committed:
+real settings never get committed:
 
 ```bash
 cp config.example.yaml config.yaml
 ```
 
-Replace the placeholder hashes with your real bcrypt hashes:
+Users, calendars, and address books are **no longer configured in
+`config.yaml`** — they live in the SQLite database and are managed with
+`nidusctl` (see below).
 
-```yaml
-users:
-  alice:
-    password: "$2b$12$<hash generated above>"
-    display_name: "Alice Smith"
-    email: "alice@example.com"
-    calendars:
-      - personal
-      - work
-    address_books:
-      - contacts
-```
-
-### 4. Run the server
+### 3. Run the server
 
 ```bash
 make run
@@ -71,6 +53,20 @@ go run ./cmd/server -config config.yaml
 
 The server starts at **http://localhost:8080**.
 
+### 4. Create a user and their resources
+
+```bash
+go run ./tools/nidusctl -config config.yaml user create alice \
+  --display-name "Alice Smith" --email alice@example.com
+# (prompts for a password; use --password to skip the prompt, e.g. in scripts)
+
+go run ./tools/nidusctl -config config.yaml calendar create alice personal
+go run ./tools/nidusctl -config config.yaml addressbook create alice contacts
+```
+
+Users can also be created/removed via the web UI (`/web/`) once logged in
+as an existing user — see **Web UI** below.
+
 ---
 
 ## Docker
@@ -256,18 +252,49 @@ tls:
   enabled: false
   cert_file: ""
   key_file:  ""
-
-users:
-  <username>:
-    password: "<bcrypt hash>"
-    display_name: "Full Name"
-    email: "user@example.com"
-    calendars:       # pre-created calendar names
-      - personal
-    address_books:   # pre-created address book names
-      - contacts
 ```
 
+Users, calendars, and address books are managed via `nidusctl`, not
+`config.yaml` — see **Managing users** below.
+
+## Managing users
+
+All user/calendar/address-book management is done with `nidusctl` (or the
+web UI). Nothing is stored in `config.yaml` anymore.
+
+```bash
+# Users
+nidusctl user create <username> [--display-name NAME] [--email EMAIL] [--password PW]
+nidusctl user delete <username>
+nidusctl user list
+nidusctl user passwd <username> [--password PW]
+
+# Calendars
+nidusctl calendar create <owner> <calendar>
+nidusctl calendar delete <owner> <calendar>
+nidusctl calendar list <owner>
+nidusctl calendar share <owner> <calendar> <user> <read|write>
+nidusctl calendar unshare <owner> <calendar> <user>
+nidusctl calendar shares <owner> <calendar>
+
+# Address books
+nidusctl addressbook create <owner> <book>
+nidusctl addressbook delete <owner> <book>
+nidusctl addressbook list <owner>
+nidusctl addressbook share <owner> <book> <user> <read|write>
+nidusctl addressbook unshare <owner> <book> <user>
+nidusctl addressbook shares <owner> <book>
+```
+
+Passwords are prompted for interactively (masked, double-entry) when
+`--password` is omitted. The web UI (`/web/`) also lets a logged-in user
+create/delete their own calendars and address books from the dashboard.
+
+> **Upgrading from an older version?** The `users:` section in
+> `config.yaml` is no longer read. Recreate your users with
+> `nidusctl user create` (and their calendars/address books) — there is no
+> automatic migration from the old config format.
+
 ---
 
 ## Project layout