Add whiteboard frame mode (Nextcloud Whiteboard / Excalidraw over WebDAV)

New third mode alongside photos/calendar: fetches a .whiteboard file
over plain WebDAV (Basic auth -- generic, not Nextcloud-specific) and
renders it via a small Node.js sidecar using Excalidraw's own real
export code (@excalidraw/utils + @resvg/resvg-js, no headless browser),
since a .whiteboard file turns out to be Excalidraw scene JSON, not an
image. The sidecar runs as a second process inside this same container
(Dockerfile installs Node, start.sh backgrounds it before exec'ing
uvicorn) rather than a separate docker-compose service -- lightweight,
stateless, reachable only at 127.0.0.1 from the Python process, nothing
worth independently scaling.

The rendered PNG is treated exactly like a photo from there on --
composed/quantized through the existing image_pipeline (letterboxed,
never cropped) rather than a second parallel rendering pipeline.

WebDAV credentials support the common "it's actually the same Nextcloud
account as my CalDAV" case (an explicit opt-in checkbox, not silently
inferred) while still working with any WebDAV server generically.
Frame-level source (URL + owning account) follows the same owner-
controls-their-own-data permission split as calendar sources and the
week view's task list: only the account owner can point a frame at it,
anyone linked can clear it.

Honest limitation: this environment has no Node.js/npm, so
render-service/ is written carefully against each library's documented
API (verified via the npm registry, including transitive dependency
licenses after the CalDAV/AGPL surprise earlier this session) but has
never actually been executed. First real docker build is the first
true test -- see render-service/README.md.

server/app/routers/frame_pages.py

@@ -152,6 +152,34 @@ def frame_calendar_page(frame_id: int, request: Request, db: Session = Depends(g
     )
 
 
+def _whiteboard_source_info(db: Session, frame: Frame) -> dict | None:
+    """Whose account this frame's whiteboard currently fetches with, for
+    showing "using <name>'s account" to everyone linked, not just
+    whoever set it. None if no source is configured."""
+    if not frame.whiteboard_user_id or not frame.whiteboard_url:
+        return None
+    user = db.get(User, frame.whiteboard_user_id)
+    if user is None:
+        return None
+    return {"user_id": user.id, "display_name": user.display_name or user.username, "url": frame.whiteboard_url}
+
+
+@router.get("/frames/{frame_id}/whiteboard", response_class=HTMLResponse)
+def frame_whiteboard_page(frame_id: int, request: Request, db: Session = Depends(get_db)):
+    viewer = current_user(request, db)
+    frame = db.get(Frame, frame_id)
+    viewer_has_webdav_creds = False
+    if viewer is not None and frame is not None and can_view_frame(db, viewer, frame):
+        viewer_has_webdav_creds = bool(
+            viewer.webdav_username or (viewer.webdav_reuse_caldav_creds and viewer.calendar_caldav_username)
+        )
+    return _frame_page(
+        request, db, frame_id, "frame_whiteboard.html", "whiteboard",
+        whiteboard_source=_whiteboard_source_info(db, frame) if frame is not None else None,
+        viewer_has_webdav_creds=viewer_has_webdav_creds,
+    )
+
+
 @router.get("/frames/{frame_id}/stats", response_class=HTMLResponse)
 def frame_stats_page(frame_id: int, request: Request, db: Session = Depends(get_db)):
     return _frame_page(request, db, frame_id, "frame_stats.html", "stats")