fix(dav): advertise only implemented protocol methods

[seonghobae]

Bounded current-base reconstruction

This stacked PR preserves the still-valuable DAV capability-truthfulness work from stale PR #1296 on top of the current security predecessor #1345 without replaying already-shipped Nano ID remediation or stale workflow-governance changes.

TDD state

Current head 3d3156ed23aae7ee2f4782abb568996af597f3fd is intentionally RED and changes only backend/tests/test_dav_api.py. The regressions require authenticated OPTIONS to advertise only the implemented DAV level/methods and require unimplemented verbs to be unregistered so the framework returns 405 Method Not Allowed with the same bounded Allow set. The predecessor implementation still advertises calendar/address-book and mutation capabilities and returns 501 from registered unsupported handlers.

Scope boundary

Production work in this slice will be limited to the DAV route capability contract needed to make runtime behavior truthful while preserving #1345's single-decode, traversal, control-character, tenant, and normalized-path protections. Provider-backed DAV mutation/writeback remains out of scope until a separately reviewed implementation enforces source capability and concurrency semantics.

Keep Draft until the RED contract is satisfied by a narrow production change, exact-head CI/security/coverage passes, review findings are resolved, and the stacked predecessor relationship remains valid. Historical evidence from #1296 does not transfer.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ba888ae-a69a-4085-9953-3bc7b1912922

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by direct consolidation into the existing develop-base owner PR #1345. #1372@3a749eb54c892157c1aed85d619e8d82efeb4fa3 and #1345@a094523deb2f83f8020ccfc8badefc48789de613 resolve to the same tree 587d9abdc050c4dede21bafd19f9530cba327957; no unique source/test tree delta remains in this Draft. Closing this duplicate preserves one current owner and avoids parallel validation of identical work.