feat: CardDAV profile sync writes through dav.Service (photo included, DAV_BASE_URL retired)

- profile.go updateCardDAV now writes directly to the shared dav_cards table via
  dav.Service (mirroring registration) instead of PUTting a vCard to
  DAV_BASE_URL over HTTP — the Go backend no longer needs the SabreDAV URL,
  only the sabredav PHP container uses the server-side credential.
- dav/types.go: ContactInput gains PhotoURL; GenerateVCard emits the
  PHOTO;VALUE=URI line when set, so the profile photo syncs into the address
  book. DAV_BASE_URL is retained in .env.example for reference only.

backend/internal/dav/types.go

@@ -77,6 +77,7 @@ type ContactInput struct {
 	Email     string
 	Phone     string
 	DOB       string
+	PhotoURL  string
 }
 
 // ============================================================================
@@ -135,6 +136,10 @@ END:VCALENDAR`, uid, dtstamp, dtstart, dtend,
 
 // GenerateVCard creates vCard format (version 3.0)
 func GenerateVCard(input ContactInput) string {
+	var photoLine string
+	if input.PhotoURL != "" {
+		photoLine = fmt.Sprintf("PHOTO;VALUE=URI:%s\n", input.PhotoURL)
+	}
 	vcard := fmt.Sprintf(`BEGIN:VCARD
 VERSION:3.0
 UID:%s
@@ -143,7 +148,7 @@ N:%s;%s;;;
 EMAIL;TYPE=INTERNET:%s
 TEL;TYPE=CELL:%s
 BDAY:%s
-REV:%s
+%sREV:%s
 END:VCARD`,
 		input.UserID,
 		input.FirstName, input.LastName,
@@ -151,6 +156,7 @@ END:VCARD`,
 		input.Email,
 		input.Phone,
 		input.DOB,
+		photoLine,
 		clock.Now().UTC().Format("20060102T150405Z"))
 
 	return vcard