Initial commit

CalDAV and CardDAV checkers sharing a single Go module. Discovery follows
RFC 6764 (/.well-known + SRV/TXT), authenticated probes cover principal,
home-set, collections and a minimal REPORT query on top of go-webdav.
Common shape in internal/dav/; CalDAV adds a scheduling rule.

Surfaces its context URL (and each secure-SRV target) as TLS endpoints via
the EndpointDiscoverer interface, so the dedicated TLS checker can pick
them up without re-parsing observations.

HTML report foregrounds common misconfigs (well-known returning 200,
missing SRV, plaintext-only SRV, missing DAV capability, skipped auth
phase) as action-item callouts before the full phase breakdown.

internal/dav/client.go

@@ -0,0 +1,39 @@
+package dav
+
+import (
+	"net/http"
+	"time"
+)
+
+// NewHTTPClient returns an http.Client with a sane default transport for
+// probing DAV servers. TLS certificate validation uses Go's default rules —
+// dedicated TLS correctness belongs in a separate checker.
+func NewHTTPClient(timeout time.Duration) *http.Client {
+	return &http.Client{
+		Timeout: timeout,
+	}
+}
+
+// basicAuthRoundTripper injects HTTP Basic credentials on every request so
+// callers can pass the same client through go-webdav's own API without losing
+// auth on internal redirects.
+type basicAuthRoundTripper struct {
+	user, pass string
+	next       http.RoundTripper
+}
+
+func (b *basicAuthRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	req.SetBasicAuth(b.user, b.pass)
+	return b.next.RoundTrip(req)
+}
+
+// WithBasicAuth clones c and attaches Basic credentials to the transport.
+func WithBasicAuth(c *http.Client, user, pass string) *http.Client {
+	nc := *c
+	base := c.Transport
+	if base == nil {
+		base = http.DefaultTransport
+	}
+	nc.Transport = &basicAuthRoundTripper{user: user, pass: pass, next: base}
+	return &nc
+}