feat(obsidian): add /api/v1/webdav file server for Obsidian vault sync (#3485 part 2) (#3678)

Part 2 of #3485. WebDAV server (PROPFIND/GET/PUT/DELETE/MKCOL/MOVE/OPTIONS) handled in the custom server layer (standalone-server-ws.mjs) since the App Router cannot export WebDAV methods. Basic-Auth (constant-time), path-traversal hardened, password decrypt ported from encryption.ts (parity-tested), DATA_DIR resolution parity-tested against dataPaths.ts. End-to-end Obsidian-over-Tailscale validation is a live VPS step (Rule #18).

scripts/dev/standalone-server-ws.mjs

@@ -2,6 +2,7 @@ import http from "node:http";
 import { randomUUID } from "node:crypto";
 import { createResponsesWsProxy } from "./responses-ws-proxy.mjs";
 import { ensurePeerStampToken, wrapRequestListenerWithPeerStamp } from "./peer-stamp.mjs";
+import { maybeHandleWebdav } from "./webdav-handler.mjs";
 
 const originalCreateServer = http.createServer.bind(http);
 const proxiesByPort = new Map();
@@ -48,12 +49,32 @@ function wrapUpgradeListener(server, listener) {
   };
 }
 
+/**
+ * Wrap a request listener so WebDAV requests at /api/v1/webdav are handled
+ * before the peer-stamp/Next.js layer sees them.
+ * Returns true if the request was handled; the wrapped listener is never called.
+ */
+function wrapRequestListenerWithWebdav(listener) {
+  return async function webdavAwareRequestHandler(req, res) {
+    try {
+      const handled = await maybeHandleWebdav(req, res);
+      if (handled) return;
+    } catch {
+      // Never block a request on WebDAV errors — fall through to Next
+    }
+    return listener.call(this, req, res);
+  };
+}
+
 http.createServer = function createServerWithResponsesWs(...args) {
   // Next's standalone server.js may pass its request listener directly to
   // createServer; wrap it so the real TCP peer IP is stamped before Next runs.
   const lastFnIdx = args.map((a) => typeof a === "function").lastIndexOf(true);
   if (lastFnIdx >= 0) {
-    args[lastFnIdx] = wrapRequestListenerWithPeerStamp(args[lastFnIdx]);
+    // WebDAV intercept wraps outermost (first to run), then peer-stamp, then Next.
+    args[lastFnIdx] = wrapRequestListenerWithWebdav(
+      wrapRequestListenerWithPeerStamp(args[lastFnIdx])
+    );
   }
 
   const server = originalCreateServer(...args);
@@ -66,7 +87,10 @@ http.createServer = function createServerWithResponsesWs(...args) {
     }
     // …or it may attach the handler via server.on("request"): wrap that too.
     if (eventName === "request" && typeof listener === "function") {
-      return originalOn(eventName, wrapRequestListenerWithPeerStamp(listener));
+      return originalOn(
+        eventName,
+        wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
+      );
     }
     return originalOn(eventName, listener);
   };
@@ -76,7 +100,10 @@ http.createServer = function createServerWithResponsesWs(...args) {
       return originalAddListener(eventName, wrapUpgradeListener(server, listener));
     }
     if (eventName === "request" && typeof listener === "function") {
-      return originalAddListener(eventName, wrapRequestListenerWithPeerStamp(listener));
+      return originalAddListener(
+        eventName,
+        wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
+      );
     }
     return originalAddListener(eventName, listener);
   };