Fix WebDAV/CalDAV/CardDAV bugs, drop username from URLs, harden concurrency

- Root handler now only serves the welcome page for GET/HEAD; all other
  methods (e.g. OPTIONS, PROPFIND) return 405 with an Allow header instead
  of always returning 200, fixing client capability probes and PROPFIND
  misbehavior.
- Mount /files/ properly and cache one xwebdav.Handler per authenticated
  user so its LockSystem persists across requests instead of being
  recreated per-request (which broke LOCK/UNLOCK).
- Remove the username segment from all DAV URLs (/cal/, /card/, /files/
  are now identical for every account; the acting user is always resolved
  via Basic Auth, never the path).
- Reintroduce a fixed literal "home" path segment (/cal/home/,
  /card/home/) to preserve the URL segment depth that go-webdav's
  caldav/carddav server relies on to classify resources (principal vs.
  home-set vs. collection vs. object). Removing the username had
  collapsed this depth, silently misclassifying requests and returning
  empty <multistatus> responses (DAVx5 "no resources found").
- Replace the store's single global mutex with per-user sharded locks so
  different users' requests no longer serialize against each other.
- Add auth.NewContext test helper, WebDAV handler tests
  (per-user isolation, lock persistence across requests), and a
  concurrent multi-user store test.
- Update README and copilot-instructions to document the new URL scheme
  and the go-webdav path-depth classification quirk.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/carddav/backend.go

@@ -38,19 +38,19 @@ func NewHandler(cfg *config.Config, st *store.Store, logger *slog.Logger) http.H
 // -------- carddav.Backend interface --------
 
 func (b *Backend) CurrentUserPrincipal(ctx context.Context) (string, error) {
-	p := auth.FromContext(ctx)
-	if p == nil {
+	if auth.FromContext(ctx) == nil {
 		return "", webdav.NewHTTPError(http.StatusUnauthorized, fmt.Errorf("not authenticated"))
 	}
-	return principalPath(p.Username), nil
+	// Must resolve to a path served by this same handler (i.e. under
+	// /card/) at exactly one path segment of depth — see cardPrincipalPath.
+	return cardPrincipalPath(), nil
 }
 
 func (b *Backend) AddressBookHomeSetPath(ctx context.Context) (string, error) {
-	p := auth.FromContext(ctx)
-	if p == nil {
+	if auth.FromContext(ctx) == nil {
 		return "", webdav.NewHTTPError(http.StatusUnauthorized, fmt.Errorf("not authenticated"))
 	}
-	return cardHomePath(p.Username), nil
+	return cardHomePath(), nil
 }
 
 func (b *Backend) ListAddressBooks(ctx context.Context) ([]carddav.AddressBook, error) {
@@ -132,7 +132,7 @@ func (b *Backend) ListAddressObjects(ctx context.Context, bookPath string, req *
 		if err != nil {
 			continue
 		}
-		obj, err := b.decodeObject(cardObjectPath(user, bookName, id), data)
+		obj, err := b.decodeObject(cardObjectPath(bookName, id), data)
 		if err != nil {
 			b.logger.Warn("decoding vcard object", "id", id, "error", err)
 			continue
@@ -202,7 +202,7 @@ func (b *Backend) DeleteAddressObject(ctx context.Context, objPath string) error
 
 func (b *Backend) bookMeta(user, name string) carddav.AddressBook {
 	return carddav.AddressBook{
-		Path:            cardHomePath(user) + name + "/",
+		Path:            cardHomePath() + name + "/",
 		Name:            name,
 		Description:     fmt.Sprintf("%s's %s address book", user, name),
 		MaxResourceSize: 10 * 1024 * 1024,
@@ -234,7 +234,7 @@ func (b *Backend) parseBookPath(ctx context.Context, bookPath string) (user, boo
 	}
 	user = p.Username
 	parts := strings.Split(strings.Trim(bookPath, "/"), "/")
-	// expected: card/<user>/<bookname>/
+	// expected: card/home/<bookname>/
 	if len(parts) < 3 {
 		return "", "", webdav.NewHTTPError(http.StatusBadRequest, fmt.Errorf("invalid address book path"))
 	}
@@ -249,7 +249,7 @@ func (b *Backend) parseObjPath(ctx context.Context, objPath string) (user, bookN
 	}
 	user = p.Username
 	parts := strings.Split(strings.Trim(objPath, "/"), "/")
-	// expected: card/<user>/<bookname>/<objid>
+	// expected: card/home/<bookname>/<objid>
 	if len(parts) < 4 {
 		return "", "", "", webdav.NewHTTPError(http.StatusBadRequest, fmt.Errorf("invalid object path"))
 	}
@@ -258,16 +258,28 @@ func (b *Backend) parseObjPath(ctx context.Context, objPath string) (user, bookN
 	return user, bookName, objID, nil
 }
 
-func principalPath(user string) string {
-	return fmt.Sprintf("/principals/%s/", user)
+// cardPrincipalPath, cardHomePath, and cardObjectPath are the same for
+// every user: authorization is resolved from the Basic Auth identity, not
+// from the URL, so no username segment is needed in the path.
+//
+// The fixed "home" segment (in place of a username) is required, not
+// cosmetic: go-webdav's carddav server classifies a request purely by how
+// many path segments it has relative to the handler's mount point — 1
+// segment is treated as the principal, 2 as the addressbook-home-set, 3 as
+// an address book, 4 as an address object. Removing that segment entirely
+// would make the home-set and address-book paths misclassified as
+// principal/home-set respectively, breaking discovery (empty PROPFIND
+// responses).
+func cardPrincipalPath() string {
+	return "/card/"
 }
 
-func cardHomePath(user string) string {
-	return fmt.Sprintf("/card/%s/", user)
+func cardHomePath() string {
+	return "/card/home/"
 }
 
-func cardObjectPath(user, bookName, objID string) string {
-	return fmt.Sprintf("/card/%s/%s/%s", user, bookName, objID)
+func cardObjectPath(bookName, objID string) string {
+	return fmt.Sprintf("/card/home/%s/%s", bookName, objID)
 }
 
 func hashBytes(data []byte) uint64 {