Add calendar color support (DAVx5 calendar-color)

Calendars can now have a color (hex, e.g. #3b82f6) that DAVx5 and other
CalDAV clients pick up via the Apple/dav4jvm calendar-color property.

- db: add calendars.color column with migration for existing DBs;
  CreateCalendarWithColor, SetCalendarColor, GetCalendarColor;
  ListCalendars now returns []Calendar{Name, Color} instead of []string
- caldav: since go-webdav's caldav.Backend interface has no extension
  point for vendor properties, wrap the handler with a response-rewriting
  middleware that injects <calendar-color xmlns="http://apple.com/ns/ical/">
  into PROPFIND responses for calendars that have a color set
- web: color picker on the "New calendar" form and an inline color swatch/
  picker on each calendar card (calendars only, not address books)
- nidusctl: `calendar create --color` flag and a new `calendar color`
  subcommand; `calendar list` now also prints the color if set

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/caldav/backend_test.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
+	"net/http"
+	"net/http/httptest"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -149,3 +151,65 @@ func TestUnauthorizedUserCannotAccessUnsharedCalendar(t *testing.T) {
 		t.Fatal("expected error accessing unshared calendar, got nil")
 	}
 }
+
+// TestPropFindEmitsCalendarColor verifies that a PROPFIND on a calendar
+// with a color set returns the Apple/DAVx5 calendar-color property, and
+// that a calendar without a color doesn't (since a client should fall
+// back to its own default in that case).
+func TestPropFindEmitsCalendarColor(t *testing.T) {
+	dir := t.TempDir()
+	st, err := store.NewStore(filepath.Join(dir, "data"))
+	if err != nil {
+		t.Fatalf("NewStore: %v", err)
+	}
+	dbase, err := db.Open(filepath.Join(dir, "test.db"))
+	if err != nil {
+		t.Fatalf("db.Open: %v", err)
+	}
+	t.Cleanup(func() { dbase.Close() })
+
+	if err := dbase.CreateUser("alice", "pw", "", ""); err != nil {
+		t.Fatalf("CreateUser alice: %v", err)
+	}
+	if err := dbase.CreateCalendarWithColor("alice", "work", "#3b82f6"); err != nil {
+		t.Fatalf("CreateCalendarWithColor: %v", err)
+	}
+	if err := dbase.CreateCalendar("alice", "personal"); err != nil {
+		t.Fatalf("CreateCalendar: %v", err)
+	}
+
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	handler := NewHandler(&config.Config{}, st, dbase, logger)
+
+	req := httptest.NewRequest("PROPFIND", "/cal/home/", strings.NewReader(
+		`<?xml version="1.0"?><a:propfind xmlns:a="DAV:"><a:allprop/></a:propfind>`))
+	req.SetBasicAuth("alice", "pw")
+	req.Header.Set("Content-Type", "text/xml")
+	req.Header.Set("Depth", "1")
+	req = req.WithContext(ctxFor("alice"))
+
+	rr := httptest.NewRecorder()
+	req = req.WithContext(auth.NewContext(context.Background(), &auth.Principal{Username: "alice"}))
+	handler.ServeHTTP(rr, req)
+
+	if rr.Code != http.StatusMultiStatus {
+		t.Fatalf("expected 207, got %d: %s", rr.Code, rr.Body.String())
+	}
+	body := rr.Body.String()
+	if !strings.Contains(body, `<calendar-color xmlns="http://apple.com/ns/ical/">#3b82f6FF</calendar-color>`) {
+		t.Fatalf("expected calendar-color for work calendar, got: %s", body)
+	}
+
+	// The "personal" calendar has no color, so its <response> block
+	// shouldn't contain the property at all.
+	personalIdx := strings.Index(body, "/cal/home/personal/")
+	if personalIdx < 0 {
+		t.Fatalf("expected personal calendar in response, got: %s", body)
+	}
+	// Find personal's response block boundaries loosely by looking for the
+	// nearest calendar-color occurrence and ensuring it isn't right next to
+	// the personal href (colors are per-block, checked via count instead).
+	if strings.Count(body, "<calendar-color ") != 1 {
+		t.Fatalf("expected exactly one calendar-color element (only for work), got: %s", body)
+	}
+}