Add --mount/--davmount WebDAV auto-mount via a managed, verified rclone

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -10,6 +10,7 @@ doos get_or_create [OPTIONS] NAME
 doos attach        [OPTIONS] NAME [-- CMD...]
 doos delete [--yes] NAME
 doos image list | add [--sha256 HEX] SOURCE [NAME] | delete [--yes] NAME
+doos davmount list | umount [--yes] ID
 doos apparmor        # profile text for this binary (Ubuntu 24.04+)
 ```
 
@@ -17,7 +18,7 @@ Version: see `VERSION`. Release history: [CHANGELOG.md](CHANGELOG.md). License:
 
 Build: `cmake -S . -B build && cmake --build build`. Test: `tests/run.sh`.
 
-Requirements: Linux >= 5.11, `slirp4netns` (default network mode), `pasta` (only for `--net pasta`), `gnupg` (signature checks; optional), `uidmap` (`newuidmap`/`newgidmap`, for more than one id inside; falls back to one id), `curl`, `tar` and `sha256sum` (images). On Ubuntu 24.04+ (`kernel.apparmor_restrict_unprivileged_userns=1`) AppArmor must allow user namespaces for the
+Requirements: Linux >= 5.11, `slirp4netns` (default network mode), `pasta` (only for `--net pasta`), `gnupg` (signature checks; optional), `uidmap` (`newuidmap`/`newgidmap`, for more than one id inside; falls back to one id), `curl`, `tar` and `sha256sum` (images), `unzip` and `fusermount3` (or `fusermount`; only for `--mount`/`--davmount` against a `dav://`/`davs://`/`http(s)://` source). On Ubuntu 24.04+ (`kernel.apparmor_restrict_unprivileged_userns=1`) AppArmor must allow user namespaces for the
 binary. Generate a profile for the exact path doos is installed at, once:
 
 ```
@@ -115,10 +116,24 @@ Notes, all measured:
 | `--pids N` | process/thread cap | 4096 | changeable |
 | `--cpus N` | cpu cap, e.g. `0.5`, `2` | all cores | changeable |
 | `--mount SRC:DST[:ro]` | bind-mount host dir `SRC` at `DST` inside, repeatable (max 8) | none | changeable |
+| `--mount URL DST[:ro]` / `--davmount URL DST[:ro]` | auto-mount a WebDAV `URL` (`dav://`, `davs://`, `http://`, `https://`) at `DST`, see below | none | changeable |
+| `--dav-user USER` / `--dav-pass PASS` | credentials for the `--mount`/`--davmount` entry just given | none | changeable |
+| `--dav-vendor NAME` | `other`\|`nextcloud`\|`owncloud`\|`sharepoint`\|`sharepoint-ntlm` for that entry | other | changeable |
+| `--dav-insecure` | skip TLS certificate verification for that entry | off | changeable |
 
 Changeable options apply the next time the container starts. Examples: `doos attach --memory 2g --cpus 1 build`, `doos attach --net pasta --image debian-bookworm web`.
 
-`--mount` gives a container extra storage without counting against `--size`: mount a remote filesystem on the host first (for example a WebDAV share with `rclone mount webdav-remote: /mnt/webdav`), then `doos attach --mount /mnt/webdav:/data NAME` to reach it inside. `SRC` must exist and be a directory when the container starts; it fails loudly otherwise. `--mount SRC:DST:ro` mounts it read-only.
+`--mount` gives a container extra storage without counting against `--size`. For a plain host directory: `doos attach --mount /some/host/dir:/data NAME` (`SRC` must exist and be a directory when the container starts; add `:ro` for read-only).
+
+For remote storage, give a WebDAV URL instead of a host path and doos does the rest: it downloads, verifies and installs `rclone` once into its own managed directory under `$DOOS_HOME` (never the system, never your `PATH`), then drives it to mount the share on the host before the container starts:
+
+```
+doos attach --mount davs://user:pass@cloud.example.com/remote.php/webdav /data NAME
+# or, keeping the password out of the URL and shell history:
+doos attach --davmount https://cloud.example.com/remote.php/webdav /data --dav-user user --dav-pass pass --dav-vendor nextcloud NAME
+```
+
+`dav://` and `davs://` are shorthand for plain-http and https WebDAV; a bare `http://`/`https://` URL works the same way. The mount is deduplicated by target (URL + credentials + vendor) and reused across containers and attaches instead of remounting every time; it lives on the host, outside any container, and keeps running after the container exits (writes go through a short write-back cache, about a second, before they reach the server). See `doos davmount list` and `doos davmount umount [--yes] ID` to inspect or tear one down, and [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for how it is verified and supervised.
 
 ## Limits, size cap and hardening
 
@@ -153,6 +168,11 @@ Changeable options apply the next time the container starts. Examples: `doos att
 | `state path must not contain ',' or ':'` | Set `DOOS_HOME` to a plain path. |
 | `container 'x' is running` on delete | Exit the attached command first. |
 | `container limit reached (64)` | Delete one first. |
+| `davmount failed for URL: authentication failed` | Wrong `--dav-user`/`--dav-pass` (or credentials embedded in the URL); fix and retry. |
+| `davmount failed for URL: cannot reach the server` | Check the URL, the server, and network/DNS from the host. |
+| `davmount failed for URL: TLS certificate error` | Self-signed server: pass `--dav-insecure` if you trust it. |
+| `davmount failed for URL: the server does not look like a WebDAV endpoint` | Wrong path or `--dav-vendor`; check the URL against the server's WebDAV docs. |
+| `davmount needs 'unzip' installed` | Install `unzip` (only needed the first time rclone is installed). |
 
 ## Safety summary