Move users, calendars, and address books from config.yaml into the database

BREAKING CHANGE: the users:/config-based collection setup is gone. All
user, calendar, and address-book data now lives in the SQLite DB
(internal/db) and is managed exclusively via nidusctl or the web UI.
Existing deployments must recreate their users after upgrading:
  nidusctl user create <username>
  nidusctl calendar create <username> <name>
  nidusctl addressbook create <username> <name>

- internal/db: new users, calendars, addressbooks tables with FK cascade
  delete; foreign_keys pragma enabled; internal/db/users.go implements
  full CRUD + bcrypt auth (CreateUser, VerifyPassword, ListUsers,
  CreateCalendar/AddressBook, etc).
- internal/config: removed Users/UserConfig entirely.
- internal/auth: Basic Auth now checks credentials via db.DB instead of
  cfg.Users.
- internal/caldav, internal/carddav: ListCalendars/ListAddressBooks and
  Create/Delete now backed by the DB.
- internal/web: login uses db.VerifyPassword; new resources.go adds
  create/delete handlers for calendars/address books at
  /web/resources/{calendar,addressbook}; dashboard gained create forms
  and per-card delete buttons (templ + htmx, no hyperscript).
- tools/nidusctl: new user create/delete/list/passwd commands (masked
  interactive password prompt via golang.org/x/term) plus create/delete/
  list subcommands for calendar/addressbook.
- cmd/server/main.go: pre-creates on-disk collections from the DB at
  startup instead of cfg.Users; warns when no users exist yet.
- Updated tests to seed data via the DB; added resources_test.go for the
  new web UI handlers.
- README.md and .github/copilot-instructions.md updated to document the
  new nidusctl commands and the DB-backed architecture.

Verified end-to-end against a live test server: nidusctl user/calendar/
addressbook create, DAV Basic Auth PROPFIND, web login, dashboard
rendering, and web UI create/delete of resources all confirmed working.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/caldav/backend.go

@@ -73,13 +73,13 @@ func (b *Backend) ListCalendars(ctx context.Context) ([]caldav.Calendar, error)
 		return nil, webdav.NewHTTPError(http.StatusUnauthorized, fmt.Errorf("not authenticated"))
 	}
 
-	user, ok := b.cfg.Users[p.Username]
-	if !ok {
-		return nil, fmt.Errorf("user not found")
+	names, err := b.dbase.ListCalendars(p.Username)
+	if err != nil {
+		return nil, fmt.Errorf("listing calendars: %w", err)
 	}
 
 	var cals []caldav.Calendar
-	for _, name := range user.Calendars {
+	for _, name := range names {
 		if err := b.store.EnsureCollection(p.Username, "cal-"+name); err != nil {
 			b.logger.Warn("ensuring calendar directory", "calendar", name, "error", err)
 			continue
@@ -87,10 +87,10 @@ func (b *Backend) ListCalendars(ctx context.Context) ([]caldav.Calendar, error)
 		cals = append(cals, b.calendarMeta(p.Username, name, name))
 	}
 
-	// Also include any extra calendars that exist on disk but aren't in config
+	// Also include any extra calendars that exist on disk but aren't registered
 	disk, _ := b.store.ListCollections(p.Username)
 	configured := make(map[string]bool)
-	for _, n := range user.Calendars {
+	for _, n := range names {
 		configured["cal-"+n] = true
 	}
 	for _, dir := range disk {
@@ -202,6 +202,9 @@ func (b *Backend) CreateCalendar(ctx context.Context, calendar *caldav.Calendar)
 	// existing calendar is done via ShareCalendar, not by creating one
 	// directly in someone else's name.
 	name := path.Base(strings.TrimSuffix(calendar.Path, "/"))
+	if err := b.dbase.CreateCalendar(p.Username, name); err != nil && err != db.ErrResourceExists {
+		return fmt.Errorf("registering calendar: %w", err)
+	}
 	return b.store.EnsureCollection(p.Username, "cal-"+name)
 }
 
@@ -214,6 +217,9 @@ func (b *Backend) DeleteCalendar(ctx context.Context, calPath string) error {
 	if err != nil {
 		return err
 	}
+	if err := b.dbase.DeleteCalendar(owner, realName); err != nil && err != db.ErrResourceNotFound {
+		return fmt.Errorf("unregistering calendar: %w", err)
+	}
 	return b.store.DeleteCollection(owner, "cal-"+realName)
 }