Add web UI: login, dashboard, and share management (templ + Tailwind + htmx)

New internal/web package mounted at /ui/, separate from DAV Basic Auth:

- Cookie-based sessions (opaque random tokens in a new web_sessions
  SQLite table, internal/db/sessions.go), checked against the same
  cfg.Users/bcrypt credentials as DAV Basic Auth.
- Dashboard listing the logged-in user's own calendars/address books,
  who they're shared with, and what's shared with them.
- Share/unshare directly from the dashboard, updated in place via htmx
  partial swaps (POST to create/update, DELETE to revoke). Always
  verifies the resource actually belongs to the logged-in user before
  granting a share.
- Templates written in templ (internal/web/templates/*.templ, generated
  *_templ.go committed), styled with Tailwind CSS v4 (web/input.css,
  compiled to web/static/app.css), with htmx vendored as a static file
  for the dynamic bits. Both are embedded into the binary at build time
  (web/staticassets.go) so the compiled server has no Node.js/web/
  runtime dependency.
- Wired into cmd/server/main.go at /ui/ alongside the existing /cal/,
  /card/, /files/ routes; welcome page links to it.
- Tests: internal/web/server_test.go covers login success/failure, the
  login-required redirect, dashboard rendering, share/unshare including
  the htmx-v2-sends-DELETE-params-as-query-string quirk, and rejecting
  shares of resources the user doesn't own.
- Docs: README (new 'Web UI' section, updated sharing section, project
  layout, dependencies) and copilot-instructions updated accordingly.
  Makefile: new templ-generate/web-deps/web-css targets.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/web/shares.go

@@ -0,0 +1,119 @@
+package web
+
+import (
+	"context"
+	"net/http"
+	"strings"
+
+	"github.com/yourusername/caldav-server/internal/web/templates"
+)
+
+// handleCalendarShare handles POST (create/update share) and DELETE
+// (revoke share) for the current user's calendars, mounted at
+// /ui/shares/calendar. htmx sends the resource + shared_with (+ permission
+// for POST) as form values and expects the updated resource card HTML
+// back for an out-of-band swap.
+func (s *Server) handleCalendarShare(w http.ResponseWriter, r *http.Request) {
+	s.handleShare(w, r, "calendar")
+}
+
+func (s *Server) handleAddressBookShare(w http.ResponseWriter, r *http.Request) {
+	s.handleShare(w, r, "addressbook")
+}
+
+func (s *Server) handleShare(w http.ResponseWriter, r *http.Request, kind string) {
+	username := userFromContext(r.Context())
+
+	if s.dbase == nil {
+		http.Error(w, "sharing is not available (no database configured)", http.StatusServiceUnavailable)
+		return
+	}
+
+	// htmx v2 sends DELETE request parameters (including hx-vals) as URL
+	// query parameters, not a request body — unlike POST/PUT/PATCH.
+	if r.Method == http.MethodDelete {
+		r.PostForm = r.URL.Query()
+	} else if err := r.ParseForm(); err != nil {
+		http.Error(w, "invalid form", http.StatusBadRequest)
+		return
+	}
+	resource := strings.TrimSpace(r.PostForm.Get("resource"))
+	sharedWith := strings.TrimSpace(r.PostForm.Get("shared_with"))
+	if resource == "" || sharedWith == "" {
+		http.Error(w, "resource and shared_with are required", http.StatusBadRequest)
+		return
+	}
+	if sharedWith == username {
+		http.Error(w, "cannot share a resource with yourself", http.StatusBadRequest)
+		return
+	}
+	if !s.ownsResource(username, kind, resource) {
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+
+	switch r.Method {
+	case http.MethodPost:
+		perm, ok := isValidPermission(r.PostForm.Get("permission"))
+		if !ok {
+			http.Error(w, "permission must be 'read' or 'write'", http.StatusBadRequest)
+			return
+		}
+		var err error
+		if kind == "calendar" {
+			err = s.dbase.ShareCalendar(username, resource, sharedWith, perm)
+		} else {
+			err = s.dbase.ShareAddressBook(username, resource, sharedWith, perm)
+		}
+		if err != nil {
+			s.logger.Error("sharing resource", "kind", kind, "error", err)
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
+	case http.MethodDelete:
+		var err error
+		if kind == "calendar" {
+			err = s.dbase.UnshareCalendar(username, resource, sharedWith)
+		} else {
+			err = s.dbase.UnshareAddressBook(username, resource, sharedWith)
+		}
+		if err != nil {
+			s.logger.Warn("unsharing resource", "kind", kind, "error", err)
+		}
+	default:
+		w.Header().Set("Allow", "POST, DELETE")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	card, err := s.resourceCardFor(username, kind, resource)
+	if err != nil {
+		s.logger.Error("rendering resource card", "error", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	_ = templates.ResourceCardView(card).Render(context.Background(), w)
+}
+
+// ownsResource checks that resource (a calendar or address book name) is
+// actually configured for username, to prevent sharing arbitrary/other
+// users' resources via a forged form post.
+func (s *Server) ownsResource(username, kind, resource string) bool {
+	user, ok := s.cfg.Users[username]
+	if !ok {
+		return false
+	}
+	var list []string
+	if kind == "calendar" {
+		list = user.Calendars
+	} else {
+		list = user.AddressBooks
+	}
+	for _, n := range list {
+		if n == resource {
+			return true
+		}
+	}
+	return false
+}