Add web UI: login, dashboard, and share management (templ + Tailwind + htmx)

New internal/web package mounted at /ui/, separate from DAV Basic Auth:

- Cookie-based sessions (opaque random tokens in a new web_sessions
  SQLite table, internal/db/sessions.go), checked against the same
  cfg.Users/bcrypt credentials as DAV Basic Auth.
- Dashboard listing the logged-in user's own calendars/address books,
  who they're shared with, and what's shared with them.
- Share/unshare directly from the dashboard, updated in place via htmx
  partial swaps (POST to create/update, DELETE to revoke). Always
  verifies the resource actually belongs to the logged-in user before
  granting a share.
- Templates written in templ (internal/web/templates/*.templ, generated
  *_templ.go committed), styled with Tailwind CSS v4 (web/input.css,
  compiled to web/static/app.css), with htmx vendored as a static file
  for the dynamic bits. Both are embedded into the binary at build time
  (web/staticassets.go) so the compiled server has no Node.js/web/
  runtime dependency.
- Wired into cmd/server/main.go at /ui/ alongside the existing /cal/,
  /card/, /files/ routes; welcome page links to it.
- Tests: internal/web/server_test.go covers login success/failure, the
  login-required redirect, dashboard rendering, share/unshare including
  the htmx-v2-sends-DELETE-params-as-query-string quirk, and rejecting
  shares of resources the user doesn't own.
- Docs: README (new 'Web UI' section, updated sharing section, project
  layout, dependencies) and copilot-instructions updated accordingly.
  Makefile: new templ-generate/web-deps/web-css targets.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/web/session.go

@@ -0,0 +1,65 @@
+package web
+
+import (
+	"context"
+	"net/http"
+	"time"
+)
+
+const sessionCookieName = "nidus_session"
+
+type ctxKey string
+
+const userCtxKey ctxKey = "web_username"
+
+// userFromContext returns the logged-in username for the current request,
+// or "" if unauthenticated.
+func userFromContext(ctx context.Context) string {
+	u, _ := ctx.Value(userCtxKey).(string)
+	return u
+}
+
+// requireLogin wraps a handler so that it redirects to /login when no
+// valid session cookie is present, otherwise it stores the username in
+// the request context for downstream handlers to use.
+func (s *Server) requireLogin(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		cookie, err := r.Cookie(sessionCookieName)
+		if err != nil {
+			http.Redirect(w, r, "/ui/login", http.StatusSeeOther)
+			return
+		}
+		username, err := s.dbase.SessionUser(cookie.Value)
+		if err != nil {
+			s.clearSessionCookie(w)
+			http.Redirect(w, r, "/ui/login", http.StatusSeeOther)
+			return
+		}
+		ctx := context.WithValue(r.Context(), userCtxKey, username)
+		next(w, r.WithContext(ctx))
+	}
+}
+
+func (s *Server) setSessionCookie(w http.ResponseWriter, token string) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     sessionCookieName,
+		Value:    token,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   s.cfg.TLS.Enabled,
+		SameSite: http.SameSiteLaxMode,
+		Expires:  time.Now().Add(7 * 24 * time.Hour),
+	})
+}
+
+func (s *Server) clearSessionCookie(w http.ResponseWriter) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     sessionCookieName,
+		Value:    "",
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   s.cfg.TLS.Enabled,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   -1,
+	})
+}