Add whiteboard frame mode (Nextcloud Whiteboard / Excalidraw over WebDAV)

New third mode alongside photos/calendar: fetches a .whiteboard file
over plain WebDAV (Basic auth -- generic, not Nextcloud-specific) and
renders it via a small Node.js sidecar using Excalidraw's own real
export code (@excalidraw/utils + @resvg/resvg-js, no headless browser),
since a .whiteboard file turns out to be Excalidraw scene JSON, not an
image. The sidecar runs as a second process inside this same container
(Dockerfile installs Node, start.sh backgrounds it before exec'ing
uvicorn) rather than a separate docker-compose service -- lightweight,
stateless, reachable only at 127.0.0.1 from the Python process, nothing
worth independently scaling.

The rendered PNG is treated exactly like a photo from there on --
composed/quantized through the existing image_pipeline (letterboxed,
never cropped) rather than a second parallel rendering pipeline.

WebDAV credentials support the common "it's actually the same Nextcloud
account as my CalDAV" case (an explicit opt-in checkbox, not silently
inferred) while still working with any WebDAV server generically.
Frame-level source (URL + owning account) follows the same owner-
controls-their-own-data permission split as calendar sources and the
week view's task list: only the account owner can point a frame at it,
anyone linked can clear it.

Honest limitation: this environment has no Node.js/npm, so
render-service/ is written carefully against each library's documented
API (verified via the npm registry, including transitive dependency
licenses after the CalDAV/AGPL surprise earlier this session) but has
never actually been executed. First real docker build is the first
true test -- see render-service/README.md.

server/app/routers/common.py

@@ -16,7 +16,7 @@ from PIL import Image
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
-from .. import caldav_client, calendar_feed, quiet_hours, weather
+from .. import caldav_client, calendar_feed, quiet_hours, weather, whiteboard
 from ..db import frame_locked
 from ..image_pipeline import render_frame
 from ..immich_client import ImmichClient
@@ -24,7 +24,7 @@ from ..models import BatteryLog, Frame, FrameCalendar, User
 
 logger = logging.getLogger(__name__)
 
-FRAME_MODES = ("photos", "calendar")
+FRAME_MODES = ("photos", "calendar", "whiteboard")
 
 # Battery-history / estimate tuning (see /frame/battery and battery_estimate_s).
 BATTERY_HISTORY_MAX = 500  # ~20 days at hourly reports
@@ -542,3 +542,50 @@ def get_or_refresh_tasks(db: Session, frame: Frame) -> list[dict]:
         locked.calendar_tasks_cached = tasks
         locked.calendar_tasks_checked_at = now
     return tasks
+
+
+def webdav_creds_for(user: User) -> tuple[str, str] | None:
+    """(username, password) for `user`'s WebDAV access -- their own
+    dedicated webdav_username/password, or (if they opted in)
+    calendar_caldav_username/password reused from their CalDAV account
+    (see models.py's User docstring on webdav_reuse_caldav_creds). None
+    if neither is actually set up."""
+    if user.webdav_reuse_caldav_creds:
+        if user.calendar_caldav_username:
+            return user.calendar_caldav_username, user.calendar_caldav_password
+        return None
+    if user.webdav_username:
+        return user.webdav_username, user.webdav_password
+    return None
+
+
+def get_or_refresh_whiteboard(db: Session, frame: Frame) -> bytes | None:
+    """Frame-level throttled render cache (calendar_feed.CHECK_INTERVAL_S)
+    -- None if no whiteboard source is configured, credentials are
+    missing (e.g. the owning user unlinked their WebDAV/CalDAV account),
+    or the most recent fetch/render failed and nothing was ever cached
+    yet. A failure after a previous success keeps showing the last
+    good render rather than going blank for one bad refresh cycle, same
+    reasoning as get_or_refresh_weather/get_or_refresh_tasks."""
+    if not frame.whiteboard_url or not frame.whiteboard_user_id:
+        return None
+    now = time.time()
+    if (frame.whiteboard_cached_image is not None
+            and now - frame.whiteboard_checked_at < calendar_feed.CHECK_INTERVAL_S):
+        return frame.whiteboard_cached_image
+
+    user = db.get(User, frame.whiteboard_user_id)
+    creds = webdav_creds_for(user) if user else None
+    if creds is None:
+        return frame.whiteboard_cached_image
+
+    try:
+        png = whiteboard.fetch_and_render(frame.whiteboard_url, creds[0], creds[1])
+    except whiteboard.WhiteboardRenderError as e:
+        logger.warning("Could not refresh whiteboard for frame %d: %s", frame.id, e)
+        return frame.whiteboard_cached_image
+
+    with frame_locked(db, frame.id) as locked:
+        locked.whiteboard_cached_image = png
+        locked.whiteboard_checked_at = now
+    return png