Add calendar color support (DAVx5 calendar-color)

Calendars can now have a color (hex, e.g. #3b82f6) that DAVx5 and other
CalDAV clients pick up via the Apple/dav4jvm calendar-color property.

- db: add calendars.color column with migration for existing DBs;
  CreateCalendarWithColor, SetCalendarColor, GetCalendarColor;
  ListCalendars now returns []Calendar{Name, Color} instead of []string
- caldav: since go-webdav's caldav.Backend interface has no extension
  point for vendor properties, wrap the handler with a response-rewriting
  middleware that injects <calendar-color xmlns="http://apple.com/ns/ical/">
  into PROPFIND responses for calendars that have a color set
- web: color picker on the "New calendar" form and an inline color swatch/
  picker on each calendar card (calendars only, not address books)
- nidusctl: `calendar create --color` flag and a new `calendar color`
  subcommand; `calendar list` now also prints the color if set

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/web/shares.go

@@ -95,15 +95,20 @@ func (s *Server) handleShare(w http.ResponseWriter, r *http.Request, kind string
 // actually configured for username, to prevent sharing arbitrary/other
 // users' resources via a forged form post.
 func (s *Server) ownsResource(username, kind, resource string) bool {
-	var (
-		list []string
-		err  error
-	)
 	if kind == "calendar" {
-		list, err = s.dbase.ListCalendars(username)
-	} else {
-		list, err = s.dbase.ListAddressBooks(username)
+		cals, err := s.dbase.ListCalendars(username)
+		if err != nil {
+			s.logger.Warn("checking resource ownership", "kind", kind, "error", err)
+			return false
+		}
+		for _, c := range cals {
+			if c.Name == resource {
+				return true
+			}
+		}
+		return false
 	}
+	list, err := s.dbase.ListAddressBooks(username)
 	if err != nil {
 		s.logger.Warn("checking resource ownership", "kind", kind, "error", err)
 		return false