Add calendar/address-book sharing backend

Introduce internal/db, a small SQLite-backed store (pure-Go
modernc.org/sqlite, no CGO) at <data_dir>/nidus.db holding
calendar_shares and addressbook_shares grant tables (owner, resource
name, shared-with user, read/write permission). This is the first step
towards user management and a web UI: a real datastore that a future
admin CLI/UI can build on, instead of the static config.yaml.

Wire sharing into the CalDAV/CardDAV backends:
- ListCalendars/ListAddressBooks now also include resources shared with
  the requesting user, exposed under the synthetic local name
  "<owner>~<name>" in the grantee's own home-set — no separate account,
  no data copying, the object still physically lives under the owner's
  store.Store namespace.
- All read paths (Get/List/QueryCalendarObjects, address book
  equivalents) resolve the synthetic name back to (owner, real name) and
  require any share (read or write) to exist.
- All write paths (Put/Delete object, DeleteCalendar/AddressBook)
  additionally require a write-permission share; read-only shares get a
  403 Forbidden.
- CreateCalendar/CreateAddressBook remain scoped to the acting user's own
  namespace — sharing an existing collection is done via ShareCalendar/
  ShareAddressBook, not by creating one directly in someone else's name.

Add internal/db/shares_test.go (grant/lookup/update/unshare/list
semantics) and internal/{caldav,carddav}/backend_test.go (shared
calendar/address book visibility, write permission enforcement,
unauthorized access rejection). Update README (features, new "Sharing
calendars and address books" section, project layout, dependencies) and
copilot-instructions.md to document the new package and sharing model.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/carddav/backend_test.go

@@ -0,0 +1,138 @@
+package carddav
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	vcard "github.com/emersion/go-vcard"
+	"github.com/yourusername/caldav-server/internal/auth"
+	"github.com/yourusername/caldav-server/internal/config"
+	"github.com/yourusername/caldav-server/internal/db"
+	"github.com/yourusername/caldav-server/internal/store"
+)
+
+func newTestBackend(t *testing.T) (*Backend, *db.DB) {
+	t.Helper()
+	dir := t.TempDir()
+
+	st, err := store.NewStore(filepath.Join(dir, "data"))
+	if err != nil {
+		t.Fatalf("NewStore: %v", err)
+	}
+	dbase, err := db.Open(filepath.Join(dir, "test.db"))
+	if err != nil {
+		t.Fatalf("db.Open: %v", err)
+	}
+	t.Cleanup(func() { dbase.Close() })
+
+	cfg := &config.Config{
+		Users: map[string]config.UserConfig{
+			"alice": {AddressBooks: []string{"contacts"}},
+			"bob":   {AddressBooks: []string{"personal"}},
+		},
+	}
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	return NewBackend(cfg, st, dbase, logger), dbase
+}
+
+func ctxFor(username string) context.Context {
+	return auth.NewContext(context.Background(), &auth.Principal{Username: username})
+}
+
+// minimalCard returns a minimal, valid vCard for use in tests.
+func minimalCard() vcard.Card {
+	const raw = "BEGIN:VCARD\r\n" +
+		"VERSION:3.0\r\n" +
+		"UID:card1@nidus.test\r\n" +
+		"FN:Test Person\r\n" +
+		"END:VCARD\r\n"
+	card, err := vcard.NewDecoder(strings.NewReader(raw)).Decode()
+	if err != nil {
+		panic("minimalCard: " + err.Error())
+	}
+	return card
+}
+
+func TestListAddressBooksIncludesSharedBook(t *testing.T) {
+	b, dbase := newTestBackend(t)
+
+	if err := dbase.ShareAddressBook("alice", "contacts", "bob", db.PermRead); err != nil {
+		t.Fatalf("ShareAddressBook: %v", err)
+	}
+	// The shared book must exist on disk for it to be listed; normally this
+	// happens when alice's own ListAddressBooks runs and ensures it.
+	if _, err := b.ListAddressBooks(ctxFor("alice")); err != nil {
+		t.Fatalf("ListAddressBooks(alice): %v", err)
+	}
+
+	books, err := b.ListAddressBooks(ctxFor("bob"))
+	if err != nil {
+		t.Fatalf("ListAddressBooks: %v", err)
+	}
+
+	var found bool
+	wantName := sharedBookName("alice", "contacts")
+	for _, book := range books {
+		if book.Name == wantName {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("shared address book %q not found in ListAddressBooks result: %+v", wantName, books)
+	}
+}
+
+func TestSharedAddressBookReadOnlyRejectsWrite(t *testing.T) {
+	b, dbase := newTestBackend(t)
+
+	if err := dbase.ShareAddressBook("alice", "contacts", "bob", db.PermRead); err != nil {
+		t.Fatalf("ShareAddressBook: %v", err)
+	}
+
+	localName := sharedBookName("alice", "contacts")
+	objPath := cardObjectPath(localName, "card1.vcf")
+
+	_, err := b.PutAddressObject(ctxFor("bob"), objPath, minimalCard(), nil)
+	if err == nil {
+		t.Fatal("expected error writing to read-only shared address book, got nil")
+	}
+}
+
+func TestSharedAddressBookWriteAllowed(t *testing.T) {
+	b, dbase := newTestBackend(t)
+
+	if err := dbase.ShareAddressBook("alice", "contacts", "bob", db.PermWrite); err != nil {
+		t.Fatalf("ShareAddressBook: %v", err)
+	}
+
+	localName := sharedBookName("alice", "contacts")
+	objPath := cardObjectPath(localName, "card1.vcf")
+
+	if _, err := b.PutAddressObject(ctxFor("bob"), objPath, minimalCard(), nil); err != nil {
+		t.Fatalf("PutAddressObject with write share: %v", err)
+	}
+
+	// The object should now be visible under alice's own address book too,
+	// since it's stored in her namespace.
+	obj, err := b.GetAddressObject(ctxFor("alice"), cardObjectPath("contacts", "card1.vcf"), nil)
+	if err != nil {
+		t.Fatalf("GetAddressObject as owner: %v", err)
+	}
+	if obj == nil {
+		t.Fatal("expected non-nil object")
+	}
+}
+
+func TestUnauthorizedUserCannotAccessUnsharedBook(t *testing.T) {
+	b, _ := newTestBackend(t)
+
+	localName := sharedBookName("alice", "contacts")
+	_, err := b.GetAddressBook(ctxFor("bob"), cardHomePath()+localName+"/")
+	if err == nil {
+		t.Fatal("expected error accessing unshared address book, got nil")
+	}
+}