App passwords; CalDAV / CardDAV server for phones, Thunderbird, macOS

App passwords (SPEC App. D §D.5): one generated password per app, shown once,
revocable on its own, revoked on a password reset; never accepted by the web
sign-in. Settings → Security → App passwords (migration 0024).

CalDAV / CardDAV server (SPEC Appendix E), built in: /dav/ with
/.well-known/caldav|carddav, HTTP Basic with app passwords only (cached checks,
throttled failures). The calendar and contacts plugins serve their own tables as
collections (Plugin(dav=...)):
- calendars as iCalendar: series with overrides, time zones, all-day, attendees
  and RSVP, alarms <-> reminders; MKCALENDAR / PROPPATCH / DELETE of calendars;
  subscriptions read-only; writes to upstream-synced calendars flow on upstream;
- address books as vCard (3.0 served, 3.0/4.0 read), groups as CATEGORIES;
- what a client stores is served back verbatim until the web app edits it;
- sync tokens / CTags from change logs filled by triggers (calendar0008,
  contacts0002), so every write path counts; trimmed nightly after 90 days.
REPORTs: calendar-query (time range), calendar-/addressbook-multiget,
addressbook-query, sync-collection. nginx and the Vite proxy route /dav/.
Settings shows the server and user name to enter; install guide §5.4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/nas-install.md

@@ -596,6 +596,24 @@ then also needs `https://ultimo.email/.well-known/assetlinks.json` naming the
 Android package and its signing-certificate fingerprint — served by nginx
 like any other static file.
 
+### 5.4 Calendars and contacts in other apps (CalDAV / CardDAV)
+
+Ultimo serves each user's calendars and address books to standard apps, which
+sync two-way with the web app: iPhone/iPad and macOS Calendar & Contacts,
+Thunderbird, Android through DAVx⁵, GNOME/Evolution.
+
+- **Server:** `https://ultimo.email/dav/` — most apps also find it from just
+  `ultimo.email` (`/.well-known/caldav`, `/.well-known/carddav`).
+- **User name:** the full Ultimo address. **Password:** an **app password**
+  (Settings → Security → App passwords) — the account password is refused, so
+  2FA cannot be bypassed and a lost device is one revocation away. Settings shows
+  the exact server and user name to type.
+- nginx passes `/dav/` and the two well-known paths to the API (in
+  `docker/nginx-app.conf`). A reverse proxy in front (QNAP, DSM) must pass them
+  too, with the `Authorization` header — the default.
+- HTTPS is required by iOS/macOS for these accounts.
+- Repeated wrong passwords are throttled per address and per IP (15 minutes).
+
 ---
 
 ## 6. Resource usage