Fix WebDAV/CalDAV/CardDAV bugs, drop username from URLs, harden concurrency

- Root handler now only serves the welcome page for GET/HEAD; all other
  methods (e.g. OPTIONS, PROPFIND) return 405 with an Allow header instead
  of always returning 200, fixing client capability probes and PROPFIND
  misbehavior.
- Mount /files/ properly and cache one xwebdav.Handler per authenticated
  user so its LockSystem persists across requests instead of being
  recreated per-request (which broke LOCK/UNLOCK).
- Remove the username segment from all DAV URLs (/cal/, /card/, /files/
  are now identical for every account; the acting user is always resolved
  via Basic Auth, never the path).
- Reintroduce a fixed literal "home" path segment (/cal/home/,
  /card/home/) to preserve the URL segment depth that go-webdav's
  caldav/carddav server relies on to classify resources (principal vs.
  home-set vs. collection vs. object). Removing the username had
  collapsed this depth, silently misclassifying requests and returning
  empty <multistatus> responses (DAVx5 "no resources found").
- Replace the store's single global mutex with per-user sharded locks so
  different users' requests no longer serialize against each other.
- Add auth.NewContext test helper, WebDAV handler tests
  (per-user isolation, lock persistence across requests), and a
  concurrent multi-user store test.
- Update README and copilot-instructions to document the new URL scheme
  and the go-webdav path-depth classification quirk.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/caldav/backend.go

@@ -38,19 +38,23 @@ func NewHandler(cfg *config.Config, st *store.Store, logger *slog.Logger) http.H
 // -------- caldav.Backend interface --------
 
 func (b *Backend) CurrentUserPrincipal(ctx context.Context) (string, error) {
-	p := auth.FromContext(ctx)
-	if p == nil {
+	if auth.FromContext(ctx) == nil {
 		return "", webdav.NewHTTPError(http.StatusUnauthorized, fmt.Errorf("not authenticated"))
 	}
-	return principalPath(p.Username), nil
+	// Must resolve to a path served by this same handler (i.e. under /cal/)
+	// at exactly one path segment of depth, since go-webdav's caldav server
+	// classifies resources purely by path depth relative to Handler.Prefix:
+	// depth 1 = principal, depth 2 = home-set, depth 3 = calendar, depth 4 =
+	// calendar object. A /principals/<user>/ path would never be reached
+	// (nothing is mounted there) and would break discovery.
+	return calPrincipalPath(), nil
 }
 
 func (b *Backend) CalendarHomeSetPath(ctx context.Context) (string, error) {
-	p := auth.FromContext(ctx)
-	if p == nil {
+	if auth.FromContext(ctx) == nil {
 		return "", webdav.NewHTTPError(http.StatusUnauthorized, fmt.Errorf("not authenticated"))
 	}
-	return calHomePath(p.Username), nil
+	return calHomePath(), nil
 }
 
 func (b *Backend) ListCalendars(ctx context.Context) ([]caldav.Calendar, error) {
@@ -132,7 +136,7 @@ func (b *Backend) ListCalendarObjects(ctx context.Context, calPath string, req *
 		if err != nil {
 			continue
 		}
-		obj, err := b.decodeObject(calObjectPath(user, calName, id), data)
+		obj, err := b.decodeObject(calObjectPath(calName, id), data)
 		if err != nil {
 			b.logger.Warn("decoding calendar object", "id", id, "error", err)
 			continue
@@ -204,7 +208,7 @@ func (b *Backend) DeleteCalendarObject(ctx context.Context, objPath string) erro
 
 func (b *Backend) calendarMeta(user, name string) caldav.Calendar {
 	return caldav.Calendar{
-		Path:                  calHomePath(user) + name + "/",
+		Path:                  calHomePath() + name + "/",
 		Name:                  name,
 		Description:           fmt.Sprintf("%s's %s calendar", user, name),
 		SupportedComponentSet: []string{"VEVENT", "VTODO", "VJOURNAL"},
@@ -236,7 +240,7 @@ func (b *Backend) parseCalPath(ctx context.Context, calPath string) (user, calNa
 	}
 	user = p.Username
 	parts := strings.Split(strings.Trim(calPath, "/"), "/")
-	// expected: cal/<user>/<calname>/
+	// expected: cal/home/<calname>/
 	if len(parts) < 3 {
 		return "", "", webdav.NewHTTPError(http.StatusBadRequest, fmt.Errorf("invalid calendar path"))
 	}
@@ -251,7 +255,7 @@ func (b *Backend) parseObjPath(ctx context.Context, objPath string) (user, calNa
 	}
 	user = p.Username
 	parts := strings.Split(strings.Trim(objPath, "/"), "/")
-	// expected: cal/<user>/<calname>/<objid>
+	// expected: cal/home/<calname>/<objid>
 	if len(parts) < 4 {
 		return "", "", "", webdav.NewHTTPError(http.StatusBadRequest, fmt.Errorf("invalid object path"))
 	}
@@ -260,16 +264,27 @@ func (b *Backend) parseObjPath(ctx context.Context, objPath string) (user, calNa
 	return user, calName, objID, nil
 }
 
-func principalPath(user string) string {
-	return fmt.Sprintf("/principals/%s/", user)
+// calPrincipalPath, calHomePath, and calObjectPath are the same for every
+// user: authorization is resolved from the Basic Auth identity, not from
+// the URL, so no username segment is needed in the path.
+//
+// The fixed "home" segment (in place of a username) is required, not
+// cosmetic: go-webdav's caldav server classifies a request purely by how
+// many path segments it has relative to the handler's mount point — 1
+// segment is treated as the principal, 2 as the calendar-home-set, 3 as a
+// calendar, 4 as a calendar object. Removing that segment entirely would
+// make the home-set and calendar paths misclassified as principal/home-set
+// respectively, breaking discovery (empty PROPFIND responses).
+func calPrincipalPath() string {
+	return "/cal/"
 }
 
-func calHomePath(user string) string {
-	return fmt.Sprintf("/cal/%s/", user)
+func calHomePath() string {
+	return "/cal/home/"
 }
 
-func calObjectPath(user, calName, objID string) string {
-	return fmt.Sprintf("/cal/%s/%s/%s", user, calName, objID)
+func calObjectPath(calName, objID string) string {
+	return fmt.Sprintf("/cal/home/%s/%s", calName, objID)
 }
 
 func hashBytes(data []byte) uint64 {