Move users, calendars, and address books from config.yaml into the database

BREAKING CHANGE: the users:/config-based collection setup is gone. All
user, calendar, and address-book data now lives in the SQLite DB
(internal/db) and is managed exclusively via nidusctl or the web UI.
Existing deployments must recreate their users after upgrading:
  nidusctl user create <username>
  nidusctl calendar create <username> <name>
  nidusctl addressbook create <username> <name>

- internal/db: new users, calendars, addressbooks tables with FK cascade
  delete; foreign_keys pragma enabled; internal/db/users.go implements
  full CRUD + bcrypt auth (CreateUser, VerifyPassword, ListUsers,
  CreateCalendar/AddressBook, etc).
- internal/config: removed Users/UserConfig entirely.
- internal/auth: Basic Auth now checks credentials via db.DB instead of
  cfg.Users.
- internal/caldav, internal/carddav: ListCalendars/ListAddressBooks and
  Create/Delete now backed by the DB.
- internal/web: login uses db.VerifyPassword; new resources.go adds
  create/delete handlers for calendars/address books at
  /web/resources/{calendar,addressbook}; dashboard gained create forms
  and per-card delete buttons (templ + htmx, no hyperscript).
- tools/nidusctl: new user create/delete/list/passwd commands (masked
  interactive password prompt via golang.org/x/term) plus create/delete/
  list subcommands for calendar/addressbook.
- cmd/server/main.go: pre-creates on-disk collections from the DB at
  startup instead of cfg.Users; warns when no users exist yet.
- Updated tests to seed data via the DB; added resources_test.go for the
  new web UI handlers.
- README.md and .github/copilot-instructions.md updated to document the
  new nidusctl commands and the DB-backed architecture.

Verified end-to-end against a live test server: nidusctl user/calendar/
addressbook create, DAV Basic Auth PROPFIND, web login, dashboard
rendering, and web UI create/delete of resources all confirmed working.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/auth/middleware.go

@@ -6,7 +6,7 @@ import (
 	"net/http"
 
 	"github.com/yourusername/caldav-server/internal/config"
-	"golang.org/x/crypto/bcrypt"
+	"github.com/yourusername/caldav-server/internal/db"
 )
 
 type contextKey string
@@ -16,11 +16,12 @@ const userContextKey contextKey = "authenticated_user"
 // Middleware wraps an http.Handler with HTTP Basic Auth enforcement.
 type Middleware struct {
 	cfg    *config.Config
+	dbase  *db.DB
 	logger *slog.Logger
 }
 
-func NewMiddleware(cfg *config.Config, logger *slog.Logger) *Middleware {
-	return &Middleware{cfg: cfg, logger: logger}
+func NewMiddleware(cfg *config.Config, dbase *db.DB, logger *slog.Logger) *Middleware {
+	return &Middleware{cfg: cfg, dbase: dbase, logger: logger}
 }
 
 // Wrap returns an http.Handler that requires valid Basic Auth credentials
@@ -65,20 +66,16 @@ func (m *Middleware) challenge(w http.ResponseWriter) {
 	_, _ = w.Write([]byte("Unauthorized"))
 }
 
-// authenticate validates username/password against config.
-func (m *Middleware) authenticate(username, password string) (*config.UserConfig, error) {
-	user, ok := m.cfg.Users[username]
-	if !ok {
-		// constant-time comparison to avoid timing attacks
-		_ = bcrypt.CompareHashAndPassword([]byte("$2b$12$invalid"), []byte(password))
+// authenticate validates username/password against the database.
+func (m *Middleware) authenticate(username, password string) (*db.User, error) {
+	user, err := m.dbase.GetUser(username)
+	if err != nil {
 		return nil, errUnauthorized
 	}
-
-	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
+	if !m.dbase.VerifyPassword(username, password) {
 		return nil, errUnauthorized
 	}
-
-	return &user, nil
+	return user, nil
 }
 
 // Principal holds the authenticated user's identity.