App passwords; CalDAV / CardDAV server for phones, Thunderbird, macOS

App passwords (SPEC App. D §D.5): one generated password per app, shown once,
revocable on its own, revoked on a password reset; never accepted by the web
sign-in. Settings → Security → App passwords (migration 0024).

CalDAV / CardDAV server (SPEC Appendix E), built in: /dav/ with
/.well-known/caldav|carddav, HTTP Basic with app passwords only (cached checks,
throttled failures). The calendar and contacts plugins serve their own tables as
collections (Plugin(dav=...)):
- calendars as iCalendar: series with overrides, time zones, all-day, attendees
  and RSVP, alarms <-> reminders; MKCALENDAR / PROPPATCH / DELETE of calendars;
  subscriptions read-only; writes to upstream-synced calendars flow on upstream;
- address books as vCard (3.0 served, 3.0/4.0 read), groups as CATEGORIES;
- what a client stores is served back verbatim until the web app edits it;
- sync tokens / CTags from change logs filled by triggers (calendar0008,
  contacts0002), so every write path counts; trimmed nightly after 90 days.
REPORTs: calendar-query (time range), calendar-/addressbook-multiget,
addressbook-query, sync-collection. nginx and the Vite proxy route /dav/.
Settings shows the server and user name to enter; install guide §5.4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker/nginx-app.conf

@@ -47,6 +47,26 @@ location /api/ {
     proxy_buffering off;
 }
 
+# ---- CalDAV / CardDAV (SPEC Appendix E) -----------------------------------
+# Phones, Thunderbird and macOS sync calendars and contacts here, signing in
+# with an app password. The well-known paths are how clients find the server
+# from just a host name.
+location /dav/ {
+    proxy_pass http://webmail_api;
+    proxy_http_version 1.1;
+    proxy_set_header Host              $host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $fwd_proto;
+    proxy_set_header X-Forwarded-Host  $host;
+    proxy_read_timeout 300s;
+}
+location ~ ^/\.well-known/(caldav|carddav)$ {
+    proxy_pass http://webmail_api;
+    proxy_set_header Host              $host;
+    proxy_set_header X-Forwarded-Proto $fwd_proto;
+}
+
 # ---- static -------------------------------------------------------------
 # Vite emits content-hashed filenames into /assets, so they are immutable.
 location /assets/ {