Add calendar/address-book sharing backend

Introduce internal/db, a small SQLite-backed store (pure-Go
modernc.org/sqlite, no CGO) at <data_dir>/nidus.db holding
calendar_shares and addressbook_shares grant tables (owner, resource
name, shared-with user, read/write permission). This is the first step
towards user management and a web UI: a real datastore that a future
admin CLI/UI can build on, instead of the static config.yaml.

Wire sharing into the CalDAV/CardDAV backends:
- ListCalendars/ListAddressBooks now also include resources shared with
  the requesting user, exposed under the synthetic local name
  "<owner>~<name>" in the grantee's own home-set — no separate account,
  no data copying, the object still physically lives under the owner's
  store.Store namespace.
- All read paths (Get/List/QueryCalendarObjects, address book
  equivalents) resolve the synthetic name back to (owner, real name) and
  require any share (read or write) to exist.
- All write paths (Put/Delete object, DeleteCalendar/AddressBook)
  additionally require a write-permission share; read-only shares get a
  403 Forbidden.
- CreateCalendar/CreateAddressBook remain scoped to the acting user's own
  namespace — sharing an existing collection is done via ShareCalendar/
  ShareAddressBook, not by creating one directly in someone else's name.

Add internal/db/shares_test.go (grant/lookup/update/unshare/list
semantics) and internal/{caldav,carddav}/backend_test.go (shared
calendar/address book visibility, write permission enforcement,
unauthorized access rejection). Update README (features, new "Sharing
calendars and address books" section, project layout, dependencies) and
copilot-instructions.md to document the new package and sharing model.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

cmd/server/main.go

@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"syscall"
 	"time"
 
@@ -16,6 +17,7 @@ import (
 	"github.com/yourusername/caldav-server/internal/caldav"
 	"github.com/yourusername/caldav-server/internal/carddav"
 	"github.com/yourusername/caldav-server/internal/config"
+	"github.com/yourusername/caldav-server/internal/db"
 	"github.com/yourusername/caldav-server/internal/store"
 	filewebdav "github.com/yourusername/caldav-server/internal/webdav"
 )
@@ -47,6 +49,15 @@ func main() {
 		os.Exit(1)
 	}
 
+	// ---- Database (calendar/address-book sharing, future user mgmt) ----
+	dbPath := filepath.Join(cfg.Storage.DataDir, "nidus.db")
+	dbase, err := db.Open(dbPath)
+	if err != nil {
+		logger.Error("initialising database", "error", err)
+		os.Exit(1)
+	}
+	defer dbase.Close()
+
 	// Pre-create default collections for each user
 	for username, user := range cfg.Users {
 		for _, cal := range user.Calendars {
@@ -65,8 +76,8 @@ func main() {
 	authMw := auth.NewMiddleware(cfg, logger)
 
 	// ---- Handlers ----
-	calHandler := caldav.NewHandler(cfg, st, logger)
-	cardHandler := carddav.NewHandler(cfg, st, logger)
+	calHandler := caldav.NewHandler(cfg, st, dbase, logger)
+	cardHandler := carddav.NewHandler(cfg, st, dbase, logger)
 	fileHandler := filewebdav.NewHandler(cfg, cfg.Storage.DataDir, logger)
 
 	mux := buildMux(cfg, authMw, calHandler, cardHandler, fileHandler, logger)