Settings: add dedicated DAV/Pushover tabs, fix CalDAV/CardDAV bugs

- Add admin DAV tab (rename from CalDAV/CardDAV) and Pushover tab
  - Add per-user Pushover tab (User Key only; App Token stays admin-managed)
  - Remove system-wide CalDAV/CardDAV fallback — per-user config only
  - Rewrite contacts_tool.py using httpx directly (caldav 2.x dropped AddressBook)
  - Fix CardDAV REPORT/PROPFIND using SOGo URL pattern
  - Fix CalDAV/CardDAV test endpoints (POST method, URL scheme normalization)
  - Fix Show Password button — API now returns actual credential values
  - Convert Credentials tab to generic key-value store; dedicated keys
    (CalDAV, Pushover, trusted_proxy) excluded via _DEDICATED_CRED_KEYS

server/database.py

@@ -393,6 +393,78 @@ _MIGRATIONS: list[list[str]] = [
     [
         "ALTER TABLE conversations ADD COLUMN IF NOT EXISTS model TEXT",
     ],
+    # v25 — Inbound webhook trigger endpoints + outbound webhook targets + monitors
+    [
+        """
+        CREATE TABLE IF NOT EXISTS webhook_endpoints (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            name TEXT NOT NULL,
+            token TEXT NOT NULL UNIQUE,
+            description TEXT DEFAULT '',
+            agent_id TEXT REFERENCES agents(id) ON DELETE CASCADE,
+            enabled BOOLEAN DEFAULT TRUE,
+            allow_get BOOLEAN DEFAULT TRUE,
+            created_at TIMESTAMPTZ DEFAULT NOW(),
+            last_triggered_at TIMESTAMPTZ,
+            trigger_count INTEGER DEFAULT 0
+        )
+        """,
+        """
+        CREATE TABLE IF NOT EXISTS webhook_targets (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            name TEXT NOT NULL UNIQUE,
+            url TEXT NOT NULL,
+            secret_header TEXT,
+            enabled BOOLEAN DEFAULT TRUE,
+            created_at TIMESTAMPTZ DEFAULT NOW()
+        )
+        """,
+        """
+        CREATE TABLE IF NOT EXISTS watched_pages (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            name TEXT NOT NULL,
+            url TEXT NOT NULL,
+            schedule TEXT NOT NULL DEFAULT '0 * * * *',
+            css_selector TEXT,
+            last_content_hash TEXT,
+            last_changed_at TIMESTAMPTZ,
+            last_checked_at TIMESTAMPTZ,
+            last_error TEXT,
+            agent_id TEXT REFERENCES agents(id) ON DELETE SET NULL,
+            notification_mode TEXT DEFAULT 'agent',
+            enabled BOOLEAN DEFAULT TRUE,
+            owner_user_id TEXT REFERENCES users(id) ON DELETE CASCADE,
+            created_at TIMESTAMPTZ DEFAULT NOW()
+        )
+        """,
+        """
+        CREATE TABLE IF NOT EXISTS rss_feeds (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            name TEXT NOT NULL,
+            url TEXT NOT NULL,
+            schedule TEXT NOT NULL DEFAULT '0 */4 * * *',
+            agent_id TEXT REFERENCES agents(id) ON DELETE SET NULL,
+            last_fetched_at TIMESTAMPTZ,
+            last_etag TEXT,
+            last_modified TEXT,
+            seen_item_ids JSONB DEFAULT '[]',
+            max_items_per_run INTEGER DEFAULT 5,
+            notification_mode TEXT DEFAULT 'agent',
+            last_error TEXT,
+            enabled BOOLEAN DEFAULT TRUE,
+            owner_user_id TEXT REFERENCES users(id) ON DELETE CASCADE,
+            created_at TIMESTAMPTZ DEFAULT NOW()
+        )
+        """,
+    ],
+    # v26 — Per-user webhook endpoint ownership
+    [
+        "ALTER TABLE webhook_endpoints ADD COLUMN IF NOT EXISTS owner_user_id TEXT REFERENCES users(id) ON DELETE CASCADE",
+    ],
+    # v27 — Per-user webhook target ownership
+    [
+        "ALTER TABLE webhook_targets ADD COLUMN IF NOT EXISTS owner_user_id TEXT REFERENCES users(id) ON DELETE CASCADE",
+    ],
 ]