Move users, calendars, and address books from config.yaml into the database

BREAKING CHANGE: the users:/config-based collection setup is gone. All
user, calendar, and address-book data now lives in the SQLite DB
(internal/db) and is managed exclusively via nidusctl or the web UI.
Existing deployments must recreate their users after upgrading:
  nidusctl user create <username>
  nidusctl calendar create <username> <name>
  nidusctl addressbook create <username> <name>

- internal/db: new users, calendars, addressbooks tables with FK cascade
  delete; foreign_keys pragma enabled; internal/db/users.go implements
  full CRUD + bcrypt auth (CreateUser, VerifyPassword, ListUsers,
  CreateCalendar/AddressBook, etc).
- internal/config: removed Users/UserConfig entirely.
- internal/auth: Basic Auth now checks credentials via db.DB instead of
  cfg.Users.
- internal/caldav, internal/carddav: ListCalendars/ListAddressBooks and
  Create/Delete now backed by the DB.
- internal/web: login uses db.VerifyPassword; new resources.go adds
  create/delete handlers for calendars/address books at
  /web/resources/{calendar,addressbook}; dashboard gained create forms
  and per-card delete buttons (templ + htmx, no hyperscript).
- tools/nidusctl: new user create/delete/list/passwd commands (masked
  interactive password prompt via golang.org/x/term) plus create/delete/
  list subcommands for calendar/addressbook.
- cmd/server/main.go: pre-creates on-disk collections from the DB at
  startup instead of cfg.Users; warns when no users exist yet.
- Updated tests to seed data via the DB; added resources_test.go for the
  new web UI handlers.
- README.md and .github/copilot-instructions.md updated to document the
  new nidusctl commands and the DB-backed architecture.

Verified end-to-end against a live test server: nidusctl user/calendar/
addressbook create, DAV Basic Auth PROPFIND, web login, dashboard
rendering, and web UI create/delete of resources all confirmed working.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

cmd/server/main.go

@@ -51,7 +51,7 @@ func main() {
 		os.Exit(1)
 	}
 
-	// ---- Database (calendar/address-book sharing, future user mgmt) ----
+	// ---- Database (users, calendars, address books, sharing) ----
 	dbPath := filepath.Join(cfg.Storage.DataDir, "nidus.db")
 	dbase, err := db.Open(dbPath)
 	if err != nil {
@@ -60,22 +60,46 @@ func main() {
 	}
 	defer dbase.Close()
 
-	// Pre-create default collections for each user
-	for username, user := range cfg.Users {
-		for _, cal := range user.Calendars {
-			if err := st.EnsureCollection(username, "cal-"+cal); err != nil {
-				logger.Warn("creating calendar collection", "user", username, "cal", cal, "error", err)
+	if n, err := dbase.UserCount(); err != nil {
+		logger.Error("counting users", "error", err)
+		os.Exit(1)
+	} else if n == 0 {
+		logger.Warn("no users exist yet — create one with: nidusctl user create <username>")
+	}
+
+	// Pre-create on-disk collections for every registered calendar/address
+	// book, in case they were added via nidusctl/web UI while the server
+	// wasn't running.
+	users, err := dbase.ListUsers()
+	if err != nil {
+		logger.Error("listing users", "error", err)
+		os.Exit(1)
+	}
+	for _, user := range users {
+		cals, err := dbase.ListCalendars(user.Username)
+		if err != nil {
+			logger.Warn("listing calendars", "user", user.Username, "error", err)
+			continue
+		}
+		for _, cal := range cals {
+			if err := st.EnsureCollection(user.Username, "cal-"+cal); err != nil {
+				logger.Warn("creating calendar collection", "user", user.Username, "cal", cal, "error", err)
 			}
 		}
-		for _, book := range user.AddressBooks {
-			if err := st.EnsureCollection(username, "card-"+book); err != nil {
-				logger.Warn("creating address book collection", "user", username, "book", book, "error", err)
+		books, err := dbase.ListAddressBooks(user.Username)
+		if err != nil {
+			logger.Warn("listing address books", "user", user.Username, "error", err)
+			continue
+		}
+		for _, book := range books {
+			if err := st.EnsureCollection(user.Username, "card-"+book); err != nil {
+				logger.Warn("creating address book collection", "user", user.Username, "book", book, "error", err)
 			}
 		}
 	}
 
 	// ---- Middleware ----
-	authMw := auth.NewMiddleware(cfg, logger)
+	authMw := auth.NewMiddleware(cfg, dbase, logger)
 
 	// ---- Handlers ----
 	calHandler := caldav.NewHandler(cfg, st, dbase, logger)