Move users, calendars, and address books from config.yaml into the database

BREAKING CHANGE: the users:/config-based collection setup is gone. All
user, calendar, and address-book data now lives in the SQLite DB
(internal/db) and is managed exclusively via nidusctl or the web UI.
Existing deployments must recreate their users after upgrading:
  nidusctl user create <username>
  nidusctl calendar create <username> <name>
  nidusctl addressbook create <username> <name>

- internal/db: new users, calendars, addressbooks tables with FK cascade
  delete; foreign_keys pragma enabled; internal/db/users.go implements
  full CRUD + bcrypt auth (CreateUser, VerifyPassword, ListUsers,
  CreateCalendar/AddressBook, etc).
- internal/config: removed Users/UserConfig entirely.
- internal/auth: Basic Auth now checks credentials via db.DB instead of
  cfg.Users.
- internal/caldav, internal/carddav: ListCalendars/ListAddressBooks and
  Create/Delete now backed by the DB.
- internal/web: login uses db.VerifyPassword; new resources.go adds
  create/delete handlers for calendars/address books at
  /web/resources/{calendar,addressbook}; dashboard gained create forms
  and per-card delete buttons (templ + htmx, no hyperscript).
- tools/nidusctl: new user create/delete/list/passwd commands (masked
  interactive password prompt via golang.org/x/term) plus create/delete/
  list subcommands for calendar/addressbook.
- cmd/server/main.go: pre-creates on-disk collections from the DB at
  startup instead of cfg.Users; warns when no users exist yet.
- Updated tests to seed data via the DB; added resources_test.go for the
  new web UI handlers.
- README.md and .github/copilot-instructions.md updated to document the
  new nidusctl commands and the DB-backed architecture.

Verified end-to-end against a live test server: nidusctl user/calendar/
addressbook create, DAV Basic Auth PROPFIND, web login, dashboard
rendering, and web UI create/delete of resources all confirmed working.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/config/config.go

@@ -9,12 +9,11 @@ import (
 
 // Config is the top-level server configuration.
 type Config struct {
-	Server  ServerConfig          `yaml:"server"`
-	Auth    AuthConfig            `yaml:"auth"`
-	Storage StorageConfig         `yaml:"storage"`
-	Users   map[string]UserConfig `yaml:"users"`
-	TLS     TLSConfig             `yaml:"tls"`
-	Logging LoggingConfig         `yaml:"logging"`
+	Server  ServerConfig  `yaml:"server"`
+	Auth    AuthConfig    `yaml:"auth"`
+	Storage StorageConfig `yaml:"storage"`
+	TLS     TLSConfig     `yaml:"tls"`
+	Logging LoggingConfig `yaml:"logging"`
 }
 
 type ServerConfig struct {
@@ -34,15 +33,6 @@ type StorageConfig struct {
 	DataDir string `yaml:"data_dir"`
 }
 
-type UserConfig struct {
-	// bcrypt-hashed password (use `htpasswd -nB <user>`)
-	Password     string   `yaml:"password"`
-	DisplayName  string   `yaml:"display_name"`
-	Email        string   `yaml:"email"`
-	Calendars    []string `yaml:"calendars"`
-	AddressBooks []string `yaml:"address_books"`
-}
-
 type TLSConfig struct {
 	Enabled  bool   `yaml:"enabled"`
 	CertFile string `yaml:"cert_file"`
@@ -105,8 +95,5 @@ func (c *Config) validate() error {
 			return fmt.Errorf("tls.cert_file and tls.key_file are required when tls is enabled")
 		}
 	}
-	if len(c.Users) == 0 {
-		return fmt.Errorf("at least one user must be configured")
-	}
 	return nil
 }