Add Nextcloud connector; reject VFS as a transfer mechanism

Investigated using the Nextcloud desktop client's Virtual Files as a
cache instead of talking to the server directly. Measured on this
machine (client 4.0.7): the configured folder holds 121,785 placeholders
against 10,267 materialised files, including 7,037 CR2 and 9,411 DNG.

Three findings, each independently disqualifying:

  - Linux VFS is *suffix* mode. A dehydrated IMG.CR2 exists only as
    IMG.CR2.nextcloud holding one byte; the real name is absent.
  - Reading a placeholder does not hydrate it. dd of the first 256KB
    returned 1 byte, the stub was unchanged, and the real name never
    appeared. There is no FUSE layer — the stub is an inert marker.
  - Even with hydration the granularity is wrong: VFS has two states,
    1 byte or all bytes, and the preview tier needs a ~256KB prefix of
    a 27MB file. That is ~100x what FR-NC-3 requires.

Recorded as ARCH §9.0. Coexistence is still supported: dr-types now
recognises *.nextcloud stubs, and the viewer lists them as "not
downloaded" rather than as corrupt files or not at all.

So the connector talks to the server directly, as D7 specified.
Implemented: Login Flow v2, PROPFIND with oc:fileid and nc:has-preview,
ETag pruning via a Depth:0 probe, range GET with local slicing when the
server ignores the header, conditional PUT, and /core/preview with
forceIcon=false. delta() returns Unsupported and says why.

Chunked upload v2 is not implemented yet — put() rejects bodies over
5MB explicitly rather than silently truncating.

Two bugs found by testing: my hand-computed epoch in a date test was a
day out (the parser was right), and quick-xml reaches EOF on truncated
input without erroring, so unbalanced elements needed an explicit check
— a half-parsed multistatus must not look like an empty directory.

83 tests passing.

ui/dr-ui/src/lib.rs

@@ -47,6 +47,16 @@ struct Loaded {
 /// preview. The remote path (FR-NC-3) fetches only a byte range, which is why
 /// the decode API takes bytes rather than a reader.
 fn load(path: &Path) -> Result<Loaded, String> {
+    // A VFS placeholder holds one byte and reading it triggers no fetch
+    // (ARCH §9.0). Say so plainly rather than reporting a decode failure.
+    if path
+        .file_name()
+        .map(|n| n.to_string_lossy().ends_with(dr_types::PLACEHOLDER_SUFFIX))
+        .unwrap_or(false)
+    {
+        return Err("not downloaded — Nextcloud placeholder".into());
+    }
+
     let bytes = std::fs::read(path).map_err(|e| e.to_string())?;
     let meta = dr_decode::metadata(&bytes).unwrap_or_default();
 
@@ -92,9 +102,21 @@ fn collect(paths: &[PathBuf]) -> Vec<PathBuf> {
     out
 }
 
+/// Whether a path names an image DarkRoom can catalogue.
+///
+/// Includes VFS placeholders: `IMG.CR2.nextcloud` is an image the user has,
+/// just not locally (ARCH §9.0). Excluding it would make a synced folder look
+/// empty rather than offline, which is the opposite of FR-NC-6c's intent.
 fn is_supported(p: &Path) -> bool {
-    p.extension()
-        .map(|e| e.to_string_lossy().to_ascii_lowercase())
+    let name = p
+        .file_name()
+        .map(|n| n.to_string_lossy())
+        .unwrap_or_default();
+    let name = name
+        .strip_suffix(dr_types::PLACEHOLDER_SUFFIX)
+        .unwrap_or(&name);
+    name.rsplit_once('.')
+        .map(|(_, ext)| ext.to_ascii_lowercase())
         .and_then(|e| dr_types::Format::from_extension(&e))
         .is_some()
 }