Fixes

[tchapi]

Discovery, OPTIONS, and LDAP hardening

• ✨ Davis answers /.well-known/caldav and /.well-known/carddav itself. No web server configuration is needed any more. The redirect is built from the application's base path, so it also works when Davis is installed in a sub-directory, which a hard-coded /dav/ rewrite never did. The rewrites are removed from the shipped Apache, nginx and Caddy configs, and the README now warns that a leftover one takes precedence and will misdirect clients.
• 🐛 OPTIONS answers for the URL that was asked about, not always the server root, so methods that only exist deeper in the tree are advertised. /dav/calendars// now offers MKCOL, MKCALENDAR. An unresolvable path falls back to the root list rather than erroring.
• 🔒 LDAP: every value substituted into LDAP_DN_PATTERN is escaped with ldap_escape(..., LDAP_ESCAPE_DN). A login name carrying DN syntax used to add structure to the DN instead of being a value inside it. The DN building moved into its own method so it can be tested.
• 🔒 Usernames are validated when an account is created — dashboard and LDAP/IMAP auto-creation — allowing letters, digits and _ . @ + ' -. A name with a slash lands in a principal URI and can collide with the delegation proxy namespace. Existing accounts are untouched: the rule only applies on creation, and authentication refuses only names that cannot work at all. Auto-creation now denies the login rather than provisioning an account with no usable principal.
• 🐛 LDAP case-insensitivity no longer splits an account in two (fixes LDAP case-insensitivity leads to duplicate accounts #167). Directories match ALICE against uid=alice, and Davis used whatever was typed, so each spelling got its own principal and, on PostgreSQL and SQLite, its own account. Davis now adopts the spelling the directory matched, taken from the DN it returns, which works whatever LDAP_DN_PATTERN is built on. This supersedes LDAP case-insensitivity #189, which canonicalised only at account creation and left the principal pointing at nothing, and which no-oped entirely unless the RDN attribute was literally uid.

Testing. Verified against OpenLDAP in a container on PostgreSQL: alice, ALICE and AlIcE all resolve to principals/alice with one account; a cn=-based entry with no uid behaves the same; wrong and empty passwords are still refused; and the case-variant login resolves to a principal that exists and shows its
calendar. 21 new tests, none of which need an LDAP server except the DN ones, which skip without ext-ldap.

Upgrade note. Installs whose stored username differs from the directory's spelling need a one-off rename; the SQL will be in the release note and was applied and verified end to end.