Add web UI: login, dashboard, and share management (templ + Tailwind + htmx)

New internal/web package mounted at /ui/, separate from DAV Basic Auth:

- Cookie-based sessions (opaque random tokens in a new web_sessions
  SQLite table, internal/db/sessions.go), checked against the same
  cfg.Users/bcrypt credentials as DAV Basic Auth.
- Dashboard listing the logged-in user's own calendars/address books,
  who they're shared with, and what's shared with them.
- Share/unshare directly from the dashboard, updated in place via htmx
  partial swaps (POST to create/update, DELETE to revoke). Always
  verifies the resource actually belongs to the logged-in user before
  granting a share.
- Templates written in templ (internal/web/templates/*.templ, generated
  *_templ.go committed), styled with Tailwind CSS v4 (web/input.css,
  compiled to web/static/app.css), with htmx vendored as a static file
  for the dynamic bits. Both are embedded into the binary at build time
  (web/staticassets.go) so the compiled server has no Node.js/web/
  runtime dependency.
- Wired into cmd/server/main.go at /ui/ alongside the existing /cal/,
  /card/, /files/ routes; welcome page links to it.
- Tests: internal/web/server_test.go covers login success/failure, the
  login-required redirect, dashboard rendering, share/unshare including
  the htmx-v2-sends-DELETE-params-as-query-string quirk, and rejecting
  shares of resources the user doesn't own.
- Docs: README (new 'Web UI' section, updated sharing section, project
  layout, dependencies) and copilot-instructions updated accordingly.
  Makefile: new templ-generate/web-deps/web-css targets.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/web/server.go

@@ -0,0 +1,100 @@
+// Package web implements the nidus web UI: a small server-rendered
+// dashboard (templ + Tailwind, htmx for partial updates) that lets users
+// log in and manage sharing of their calendars and address books. It is
+// intentionally separate from the DAV Basic Auth (internal/auth) — the
+// web UI uses cookie-based sessions stored in internal/db.
+package web
+
+import (
+	"log/slog"
+	"net/http"
+	"strings"
+
+	"github.com/yourusername/caldav-server/internal/config"
+	"github.com/yourusername/caldav-server/internal/db"
+	"github.com/yourusername/caldav-server/internal/store"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// Server holds the dependencies needed by the web UI handlers.
+type Server struct {
+	cfg    *config.Config
+	store  *store.Store
+	dbase  *db.DB
+	logger *slog.Logger
+}
+
+// NewServer constructs a web UI Server.
+func NewServer(cfg *config.Config, st *store.Store, dbase *db.DB, logger *slog.Logger) *Server {
+	return &Server{cfg: cfg, store: st, dbase: dbase, logger: logger}
+}
+
+// Handler returns the http.Handler serving the web UI, mounted at "/ui/"
+// by the caller (cmd/server). staticFS serves the compiled Tailwind CSS
+// and any other static assets.
+func (s *Server) Handler(staticFS http.FileSystem) http.Handler {
+	mux := http.NewServeMux()
+
+	mux.Handle("/ui/static/", http.StripPrefix("/ui/static/", http.FileServer(staticFS)))
+
+	mux.HandleFunc("/ui/login", s.handleLogin)
+	mux.HandleFunc("/ui/logout", s.handleLogout)
+	mux.HandleFunc("/ui/", s.requireLogin(s.handleDashboard))
+	mux.HandleFunc("/ui/shares/calendar", s.requireLogin(s.handleCalendarShare))
+	mux.HandleFunc("/ui/shares/addressbook", s.requireLogin(s.handleAddressBookShare))
+
+	return mux
+}
+
+// authenticate validates username/password against the configured users,
+// mirroring internal/auth's Basic Auth check.
+func (s *Server) authenticate(username, password string) bool {
+	user, ok := s.cfg.Users[username]
+	if !ok {
+		_ = bcrypt.CompareHashAndPassword([]byte("$2b$12$invalidinvalidinvalidinvalidinvalidinval"), []byte(password))
+		return false
+	}
+	return bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)) == nil
+}
+
+func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
+	if r.Method == http.MethodGet {
+		renderLogin(w, "")
+		return
+	}
+	if r.Method != http.MethodPost {
+		w.Header().Set("Allow", "GET, POST")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	if err := r.ParseForm(); err != nil {
+		renderLogin(w, "invalid form submission")
+		return
+	}
+	username := strings.TrimSpace(r.PostForm.Get("username"))
+	password := r.PostForm.Get("password")
+
+	if !s.authenticate(username, password) {
+		s.logger.Warn("web login failed", "username", username, "remote_addr", r.RemoteAddr)
+		renderLogin(w, "invalid username or password")
+		return
+	}
+
+	token, err := s.dbase.CreateSession(username)
+	if err != nil {
+		s.logger.Error("creating web session", "error", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	s.setSessionCookie(w, token)
+	http.Redirect(w, r, "/ui/", http.StatusSeeOther)
+}
+
+func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
+	if cookie, err := r.Cookie(sessionCookieName); err == nil {
+		_ = s.dbase.DeleteSession(cookie.Value)
+	}
+	s.clearSessionCookie(w)
+	http.Redirect(w, r, "/ui/login", http.StatusSeeOther)
+}