Add web UI: login, dashboard, and share management (templ + Tailwind + htmx)

New internal/web package mounted at /ui/, separate from DAV Basic Auth:

- Cookie-based sessions (opaque random tokens in a new web_sessions
  SQLite table, internal/db/sessions.go), checked against the same
  cfg.Users/bcrypt credentials as DAV Basic Auth.
- Dashboard listing the logged-in user's own calendars/address books,
  who they're shared with, and what's shared with them.
- Share/unshare directly from the dashboard, updated in place via htmx
  partial swaps (POST to create/update, DELETE to revoke). Always
  verifies the resource actually belongs to the logged-in user before
  granting a share.
- Templates written in templ (internal/web/templates/*.templ, generated
  *_templ.go committed), styled with Tailwind CSS v4 (web/input.css,
  compiled to web/static/app.css), with htmx vendored as a static file
  for the dynamic bits. Both are embedded into the binary at build time
  (web/staticassets.go) so the compiled server has no Node.js/web/
  runtime dependency.
- Wired into cmd/server/main.go at /ui/ alongside the existing /cal/,
  /card/, /files/ routes; welcome page links to it.
- Tests: internal/web/server_test.go covers login success/failure, the
  login-required redirect, dashboard rendering, share/unshare including
  the htmx-v2-sends-DELETE-params-as-query-string quirk, and rejecting
  shares of resources the user doesn't own.
- Docs: README (new 'Web UI' section, updated sharing section, project
  layout, dependencies) and copilot-instructions updated accordingly.
  Makefile: new templ-generate/web-deps/web-css targets.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/db/db.go

@@ -72,6 +72,16 @@ CREATE TABLE IF NOT EXISTS addressbook_shares (
 	created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
 	UNIQUE (owner, addressbook_name, shared_with)
 );
+
+-- Web UI login sessions. Sessions are opaque random tokens stored server
+-- side (not JWTs) so they can be revoked instantly by deleting the row.
+CREATE TABLE IF NOT EXISTS web_sessions (
+	token TEXT PRIMARY KEY,
+	username TEXT NOT NULL,
+	created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	expires_at DATETIME NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_web_sessions_expires_at ON web_sessions (expires_at);
 `
 	_, err := d.conn.Exec(schema)
 	return err

internal/db/sessions.go

@@ -0,0 +1,80 @@
+package db
+
+import (
+	"crypto/rand"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"time"
+)
+
+// ErrSessionNotFound is returned when a session token doesn't exist or has
+// expired.
+var ErrSessionNotFound = errors.New("session not found")
+
+// SessionTTL is how long a web UI login session stays valid after creation.
+const SessionTTL = 7 * 24 * time.Hour
+
+// CreateSession generates a new random session token for username and
+// stores it with an expiry SessionTTL from now. Returns the token to be
+// set as a cookie value.
+func (d *DB) CreateSession(username string) (string, error) {
+	token, err := randomToken()
+	if err != nil {
+		return "", err
+	}
+	expires := time.Now().Add(SessionTTL)
+	_, err = d.conn.Exec(
+		`INSERT INTO web_sessions (token, username, expires_at) VALUES (?, ?, ?)`,
+		token, username, expires,
+	)
+	if err != nil {
+		return "", err
+	}
+	return token, nil
+}
+
+// SessionUser returns the username associated with token, provided it
+// exists and hasn't expired. Returns ErrSessionNotFound otherwise.
+func (d *DB) SessionUser(token string) (string, error) {
+	var username string
+	var expiresAt time.Time
+	err := d.conn.QueryRow(
+		`SELECT username, expires_at FROM web_sessions WHERE token = ?`,
+		token,
+	).Scan(&username, &expiresAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", ErrSessionNotFound
+	}
+	if err != nil {
+		return "", err
+	}
+	if time.Now().After(expiresAt) {
+		_ = d.DeleteSession(token)
+		return "", ErrSessionNotFound
+	}
+	return username, nil
+}
+
+// DeleteSession removes a session (used on logout). It's not an error if
+// the token doesn't exist.
+func (d *DB) DeleteSession(token string) error {
+	_, err := d.conn.Exec(`DELETE FROM web_sessions WHERE token = ?`, token)
+	return err
+}
+
+// PruneExpiredSessions deletes all sessions past their expiry. Intended to
+// be called periodically (e.g. on server startup and via a background
+// ticker) to keep the table small.
+func (d *DB) PruneExpiredSessions() error {
+	_, err := d.conn.Exec(`DELETE FROM web_sessions WHERE expires_at < ?`, time.Now())
+	return err
+}
+
+func randomToken() (string, error) {
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(buf), nil
+}