Fix WebDAV/CalDAV/CardDAV bugs, drop username from URLs, harden concurrency

- Root handler now only serves the welcome page for GET/HEAD; all other
  methods (e.g. OPTIONS, PROPFIND) return 405 with an Allow header instead
  of always returning 200, fixing client capability probes and PROPFIND
  misbehavior.
- Mount /files/ properly and cache one xwebdav.Handler per authenticated
  user so its LockSystem persists across requests instead of being
  recreated per-request (which broke LOCK/UNLOCK).
- Remove the username segment from all DAV URLs (/cal/, /card/, /files/
  are now identical for every account; the acting user is always resolved
  via Basic Auth, never the path).
- Reintroduce a fixed literal "home" path segment (/cal/home/,
  /card/home/) to preserve the URL segment depth that go-webdav's
  caldav/carddav server relies on to classify resources (principal vs.
  home-set vs. collection vs. object). Removing the username had
  collapsed this depth, silently misclassifying requests and returning
  empty <multistatus> responses (DAVx5 "no resources found").
- Replace the store's single global mutex with per-user sharded locks so
  different users' requests no longer serialize against each other.
- Add auth.NewContext test helper, WebDAV handler tests
  (per-user isolation, lock persistence across requests), and a
  concurrent multi-user store test.
- Update README and copilot-instructions to document the new URL scheme
  and the go-webdav path-depth classification quirk.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

README.md

@@ -87,7 +87,7 @@ docker run -p 8080:8080 \
    - **Server**: `http://yourserver:8080`
    - **Username**: `alice`
    - **Password**: your plaintext password
-3. The app will auto-discover calendars at `/cal/alice/`.
+3. The app will auto-discover calendars at `/cal/`.
 
 Same flow for **CardDAV** with Contacts app.
 
@@ -110,13 +110,23 @@ Use the GNOME Online Accounts panel:
 |------|-------------|
 | `/.well-known/caldav` | Redirects to `/cal/` |
 | `/.well-known/carddav` | Redirects to `/card/` |
-| `/cal/<user>/` | CalDAV home |
-| `/cal/<user>/<calendar>/` | Calendar collection |
-| `/card/<user>/` | CardDAV home |
-| `/card/<user>/<book>/` | Address book collection |
-| `/files/<user>/` | WebDAV file storage |
+| `/cal/` | CalDAV principal (same URL for every user; resolved via Basic Auth) |
+| `/cal/home/` | Calendar home-set (lists the user's calendars) |
+| `/cal/home/<calendar>/` | Calendar collection |
+| `/card/` | CardDAV principal (same URL for every user; resolved via Basic Auth) |
+| `/card/home/` | Address book home-set (lists the user's address books) |
+| `/card/home/<book>/` | Address book collection |
+| `/files/` | WebDAV file storage (same URL for every user; resolved via Basic Auth) |
 | `/healthz` | Health check (unauthenticated) |
 
+> **Note:** the `home` segment is a fixed literal (not a username or real
+> resource) — it exists only to give the calendar/address-book home-set the
+> path depth that the underlying CalDAV/CardDAV library expects when
+> classifying resources by URL. Clients should never need to construct
+> these URLs by hand; they're discovered automatically via
+> `.well-known` + `current-user-principal` + `calendar-home-set` /
+> `addressbook-home-set` properties.
+
 ---
 
 ## TLS / Reverse proxy