Add calendar/address-book sharing backend

Introduce internal/db, a small SQLite-backed store (pure-Go
modernc.org/sqlite, no CGO) at <data_dir>/nidus.db holding
calendar_shares and addressbook_shares grant tables (owner, resource
name, shared-with user, read/write permission). This is the first step
towards user management and a web UI: a real datastore that a future
admin CLI/UI can build on, instead of the static config.yaml.

Wire sharing into the CalDAV/CardDAV backends:
- ListCalendars/ListAddressBooks now also include resources shared with
  the requesting user, exposed under the synthetic local name
  "<owner>~<name>" in the grantee's own home-set — no separate account,
  no data copying, the object still physically lives under the owner's
  store.Store namespace.
- All read paths (Get/List/QueryCalendarObjects, address book
  equivalents) resolve the synthetic name back to (owner, real name) and
  require any share (read or write) to exist.
- All write paths (Put/Delete object, DeleteCalendar/AddressBook)
  additionally require a write-permission share; read-only shares get a
  403 Forbidden.
- CreateCalendar/CreateAddressBook remain scoped to the acting user's own
  namespace — sharing an existing collection is done via ShareCalendar/
  ShareAddressBook, not by creating one directly in someone else's name.

Add internal/db/shares_test.go (grant/lookup/update/unshare/list
semantics) and internal/{caldav,carddav}/backend_test.go (shared
calendar/address book visibility, write permission enforcement,
unauthorized access rejection). Update README (features, new "Sharing
calendars and address books" section, project layout, dependencies) and
copilot-instructions.md to document the new package and sharing model.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/db/shares_test.go

@@ -0,0 +1,154 @@
+package db
+
+import (
+	"errors"
+	"path/filepath"
+	"testing"
+)
+
+func openTestDB(t *testing.T) *DB {
+	t.Helper()
+	dbase, err := Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	t.Cleanup(func() { dbase.Close() })
+	return dbase
+}
+
+func TestShareCalendarAndLookup(t *testing.T) {
+	dbase := openTestDB(t)
+
+	if err := dbase.ShareCalendar("alice", "work", "bob", PermRead); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+
+	share, err := dbase.CalendarShareFor("alice", "work", "bob")
+	if err != nil {
+		t.Fatalf("CalendarShareFor: %v", err)
+	}
+	if share.Permission != PermRead {
+		t.Errorf("Permission = %q, want %q", share.Permission, PermRead)
+	}
+
+	// Re-sharing with a different permission updates in place rather than
+	// erroring or duplicating.
+	if err := dbase.ShareCalendar("alice", "work", "bob", PermWrite); err != nil {
+		t.Fatalf("ShareCalendar (update): %v", err)
+	}
+	share, err = dbase.CalendarShareFor("alice", "work", "bob")
+	if err != nil {
+		t.Fatalf("CalendarShareFor after update: %v", err)
+	}
+	if share.Permission != PermWrite {
+		t.Errorf("Permission after update = %q, want %q", share.Permission, PermWrite)
+	}
+
+	shares, err := dbase.SharesOfCalendar("alice", "work")
+	if err != nil {
+		t.Fatalf("SharesOfCalendar: %v", err)
+	}
+	if len(shares) != 1 || shares[0].SharedWith != "bob" {
+		t.Errorf("SharesOfCalendar = %+v, want single share with bob", shares)
+	}
+}
+
+func TestCalendarShareForNotFound(t *testing.T) {
+	dbase := openTestDB(t)
+
+	_, err := dbase.CalendarShareFor("alice", "work", "bob")
+	if !errors.Is(err, ErrShareNotFound) {
+		t.Errorf("err = %v, want ErrShareNotFound", err)
+	}
+}
+
+func TestUnshareCalendar(t *testing.T) {
+	dbase := openTestDB(t)
+
+	if err := dbase.ShareCalendar("alice", "work", "bob", PermRead); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+	if err := dbase.UnshareCalendar("alice", "work", "bob"); err != nil {
+		t.Fatalf("UnshareCalendar: %v", err)
+	}
+	if _, err := dbase.CalendarShareFor("alice", "work", "bob"); !errors.Is(err, ErrShareNotFound) {
+		t.Errorf("share still present after unshare: err = %v", err)
+	}
+
+	// Unsharing a non-existent share reports ErrShareNotFound.
+	if err := dbase.UnshareCalendar("alice", "work", "bob"); !errors.Is(err, ErrShareNotFound) {
+		t.Errorf("UnshareCalendar (already gone) = %v, want ErrShareNotFound", err)
+	}
+}
+
+func TestCalendarsSharedWith(t *testing.T) {
+	dbase := openTestDB(t)
+
+	if err := dbase.ShareCalendar("alice", "work", "bob", PermRead); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+	if err := dbase.ShareCalendar("carol", "family", "bob", PermWrite); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+	// A share for a different user shouldn't show up for bob.
+	if err := dbase.ShareCalendar("alice", "personal", "dave", PermRead); err != nil {
+		t.Fatalf("ShareCalendar: %v", err)
+	}
+
+	shares, err := dbase.CalendarsSharedWith("bob")
+	if err != nil {
+		t.Fatalf("CalendarsSharedWith: %v", err)
+	}
+	if len(shares) != 2 {
+		t.Fatalf("len(shares) = %d, want 2", len(shares))
+	}
+}
+
+func TestShareCalendarInvalidPermission(t *testing.T) {
+	dbase := openTestDB(t)
+	if err := dbase.ShareCalendar("alice", "work", "bob", Permission("admin")); err == nil {
+		t.Error("expected error for invalid permission, got nil")
+	}
+}
+
+func TestShareAddressBookAndLookup(t *testing.T) {
+	dbase := openTestDB(t)
+
+	if err := dbase.ShareAddressBook("alice", "contacts", "bob", PermRead); err != nil {
+		t.Fatalf("ShareAddressBook: %v", err)
+	}
+
+	share, err := dbase.AddressBookShareFor("alice", "contacts", "bob")
+	if err != nil {
+		t.Fatalf("AddressBookShareFor: %v", err)
+	}
+	if share.Permission != PermRead {
+		t.Errorf("Permission = %q, want %q", share.Permission, PermRead)
+	}
+
+	if err := dbase.UnshareAddressBook("alice", "contacts", "bob"); err != nil {
+		t.Fatalf("UnshareAddressBook: %v", err)
+	}
+	if _, err := dbase.AddressBookShareFor("alice", "contacts", "bob"); !errors.Is(err, ErrShareNotFound) {
+		t.Errorf("share still present after unshare: err = %v", err)
+	}
+}
+
+func TestAddressBooksSharedWith(t *testing.T) {
+	dbase := openTestDB(t)
+
+	if err := dbase.ShareAddressBook("alice", "contacts", "bob", PermRead); err != nil {
+		t.Fatalf("ShareAddressBook: %v", err)
+	}
+	if err := dbase.ShareAddressBook("carol", "friends", "bob", PermWrite); err != nil {
+		t.Fatalf("ShareAddressBook: %v", err)
+	}
+
+	shares, err := dbase.AddressBooksSharedWith("bob")
+	if err != nil {
+		t.Fatalf("AddressBooksSharedWith: %v", err)
+	}
+	if len(shares) != 2 {
+		t.Fatalf("len(shares) = %d, want 2", len(shares))
+	}
+}