Move users, calendars, and address books from config.yaml into the database

BREAKING CHANGE: the users:/config-based collection setup is gone. All
user, calendar, and address-book data now lives in the SQLite DB
(internal/db) and is managed exclusively via nidusctl or the web UI.
Existing deployments must recreate their users after upgrading:
  nidusctl user create <username>
  nidusctl calendar create <username> <name>
  nidusctl addressbook create <username> <name>

- internal/db: new users, calendars, addressbooks tables with FK cascade
  delete; foreign_keys pragma enabled; internal/db/users.go implements
  full CRUD + bcrypt auth (CreateUser, VerifyPassword, ListUsers,
  CreateCalendar/AddressBook, etc).
- internal/config: removed Users/UserConfig entirely.
- internal/auth: Basic Auth now checks credentials via db.DB instead of
  cfg.Users.
- internal/caldav, internal/carddav: ListCalendars/ListAddressBooks and
  Create/Delete now backed by the DB.
- internal/web: login uses db.VerifyPassword; new resources.go adds
  create/delete handlers for calendars/address books at
  /web/resources/{calendar,addressbook}; dashboard gained create forms
  and per-card delete buttons (templ + htmx, no hyperscript).
- tools/nidusctl: new user create/delete/list/passwd commands (masked
  interactive password prompt via golang.org/x/term) plus create/delete/
  list subcommands for calendar/addressbook.
- cmd/server/main.go: pre-creates on-disk collections from the DB at
  startup instead of cfg.Users; warns when no users exist yet.
- Updated tests to seed data via the DB; added resources_test.go for the
  new web UI handlers.
- README.md and .github/copilot-instructions.md updated to document the
  new nidusctl commands and the DB-backed architecture.

Verified end-to-end against a live test server: nidusctl user/calendar/
addressbook create, DAV Basic Auth PROPFIND, web login, dashboard
rendering, and web UI create/delete of resources all confirmed working.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/web/server_test.go

@@ -14,7 +14,6 @@ import (
 	"github.com/yourusername/caldav-server/internal/config"
 	"github.com/yourusername/caldav-server/internal/db"
 	"github.com/yourusername/caldav-server/internal/store"
-	"golang.org/x/crypto/bcrypt"
 )
 
 func newTestServer(t *testing.T) *Server {
@@ -31,16 +30,21 @@ func newTestServer(t *testing.T) *Server {
 	}
 	t.Cleanup(func() { dbase.Close() })
 
-	hash, err := bcrypt.GenerateFromPassword([]byte("password"), bcrypt.MinCost)
-	if err != nil {
-		t.Fatalf("GenerateFromPassword: %v", err)
+	cfg := &config.Config{}
+	if err := dbase.CreateUser("alice", "password", "", ""); err != nil {
+		t.Fatalf("CreateUser alice: %v", err)
 	}
-
-	cfg := &config.Config{
-		Users: map[string]config.UserConfig{
-			"alice": {Password: string(hash), Calendars: []string{"work"}, AddressBooks: []string{"contacts"}},
-			"bob":   {Password: string(hash), Calendars: []string{"personal"}},
-		},
+	if err := dbase.CreateUser("bob", "password", "", ""); err != nil {
+		t.Fatalf("CreateUser bob: %v", err)
+	}
+	if err := dbase.CreateCalendar("alice", "work"); err != nil {
+		t.Fatalf("CreateCalendar alice/work: %v", err)
+	}
+	if err := dbase.CreateAddressBook("alice", "contacts"); err != nil {
+		t.Fatalf("CreateAddressBook alice/contacts: %v", err)
+	}
+	if err := dbase.CreateCalendar("bob", "personal"); err != nil {
+		t.Fatalf("CreateCalendar bob/personal: %v", err)
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
 	return NewServer(cfg, st, dbase, logger)