Add calendar/address-book sharing backend

Introduce internal/db, a small SQLite-backed store (pure-Go
modernc.org/sqlite, no CGO) at <data_dir>/nidus.db holding
calendar_shares and addressbook_shares grant tables (owner, resource
name, shared-with user, read/write permission). This is the first step
towards user management and a web UI: a real datastore that a future
admin CLI/UI can build on, instead of the static config.yaml.

Wire sharing into the CalDAV/CardDAV backends:
- ListCalendars/ListAddressBooks now also include resources shared with
  the requesting user, exposed under the synthetic local name
  "<owner>~<name>" in the grantee's own home-set — no separate account,
  no data copying, the object still physically lives under the owner's
  store.Store namespace.
- All read paths (Get/List/QueryCalendarObjects, address book
  equivalents) resolve the synthetic name back to (owner, real name) and
  require any share (read or write) to exist.
- All write paths (Put/Delete object, DeleteCalendar/AddressBook)
  additionally require a write-permission share; read-only shares get a
  403 Forbidden.
- CreateCalendar/CreateAddressBook remain scoped to the acting user's own
  namespace — sharing an existing collection is done via ShareCalendar/
  ShareAddressBook, not by creating one directly in someone else's name.

Add internal/db/shares_test.go (grant/lookup/update/unshare/list
semantics) and internal/{caldav,carddav}/backend_test.go (shared
calendar/address book visibility, write permission enforcement,
unauthorized access rejection). Update README (features, new "Sharing
calendars and address books" section, project layout, dependencies) and
copilot-instructions.md to document the new package and sharing model.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/db/db.go

@@ -0,0 +1,69 @@
+// Package db provides a lightweight SQLite-backed store for data that
+// doesn't fit the plain-file model used by internal/store — currently
+// calendar/address-book sharing grants. It's intentionally small: no ORM,
+// just database/sql with hand-written queries, so it stays easy to
+// extend when user management and the web UI are added later.
+package db
+
+import (
+	"database/sql"
+	"fmt"
+
+	_ "modernc.org/sqlite"
+)
+
+// DB wraps a SQLite connection and exposes typed helpers for the
+// application's tables.
+type DB struct {
+	conn *sql.DB
+}
+
+// Open opens (creating if necessary) the SQLite database at path and runs
+// schema migrations.
+func Open(path string) (*DB, error) {
+	conn, err := sql.Open("sqlite", path)
+	if err != nil {
+		return nil, fmt.Errorf("opening database %q: %w", path, err)
+	}
+	// SQLite only supports one writer at a time; a single connection avoids
+	// "database is locked" errors under concurrent access.
+	conn.SetMaxOpenConns(1)
+
+	d := &DB{conn: conn}
+	if err := d.migrate(); err != nil {
+		conn.Close()
+		return nil, fmt.Errorf("migrating database: %w", err)
+	}
+	return d, nil
+}
+
+// Close closes the underlying connection.
+func (d *DB) Close() error {
+	return d.conn.Close()
+}
+
+func (d *DB) migrate() error {
+	const schema = `
+CREATE TABLE IF NOT EXISTS calendar_shares (
+	id INTEGER PRIMARY KEY AUTOINCREMENT,
+	owner TEXT NOT NULL,
+	calendar_name TEXT NOT NULL,
+	shared_with TEXT NOT NULL,
+	permission TEXT NOT NULL CHECK (permission IN ('read', 'write')),
+	created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	UNIQUE (owner, calendar_name, shared_with)
+);
+
+CREATE TABLE IF NOT EXISTS addressbook_shares (
+	id INTEGER PRIMARY KEY AUTOINCREMENT,
+	owner TEXT NOT NULL,
+	addressbook_name TEXT NOT NULL,
+	shared_with TEXT NOT NULL,
+	permission TEXT NOT NULL CHECK (permission IN ('read', 'write')),
+	created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	UNIQUE (owner, addressbook_name, shared_with)
+);
+`
+	_, err := d.conn.Exec(schema)
+	return err
+}