Add --mount/--davmount WebDAV auto-mount via a managed, verified rclone

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -9,15 +9,16 @@ How doos works internally. The behavior contract is [SPEC](../SPEC.md); this exp
 | File | Class / role |
 |---|---|
 | `src/spec.hpp` | `spec::` constants: caps, mount lists, device list, paths. Single source of truth with `SPEC.md`. |
-| `src/util.{hpp,cpp}` | `SysError`, `Fd` (RAII fd), `FileLock` (bounded flock), `parseSize`/`formatSize`, `base64Decode`, `runProcess` (fork/exec, capped capture), `fsutil` (mkdirs, read/write, bounded `removeTree`, `mirrorDirs` skeleton, `copyTree`/`copyEntries` (with skip predicate), `copyFiles`, `diskUsage` with hardlink dedupe). |
+| `src/util.{hpp,cpp}` | `SysError`, `Fd` (RAII fd), `FileLock` (bounded flock), `parseSize`/`formatSize`, `base64Decode`, `runProcess` (fork/exec, capped capture), `fetchText`/`fetchFile` (curl, https only, capped), `TempDir` (scratch dir under the state dir, removed on scope exit), `isHex64`, `verifyDetachedSignature`/`verifyClearsignedSignature` (gpg with a throwaway home, pinned fingerprint; shared by `image.cpp` and `davmount.cpp`), `fsutil` (mkdirs, read/write, bounded `removeTree`, `mirrorDirs` skeleton, `copyTree`/`copyEntries` (with skip predicate), `copyFiles`, `diskUsage` with hardlink dedupe). |
 | `src/idmap.{hpp,cpp}` | `IdMap` (single or subuid mapping via newuidmap/newgidmap, subuid range lookup), `UserNsJob` (run a function as root of a user namespace with the same map: image extraction, deleting subuid-owned trees). |
-| `src/image.{hpp,cpp}` | `Catalog` (alpine, ubuntu, debian resolution from publishers), `verifySignature` (gpg with a throwaway home, pinned fingerprint), `ImageStore` (add with download, sha256 and signature check, extraction; list; delete). |
+| `src/image.{hpp,cpp}` | `Catalog` (alpine, ubuntu, debian resolution from publishers), `ImageStore` (add with download, sha256 and signature check via `util::verifyDetachedSignature`, extraction; list; delete). |
+| `src/davmount.{hpp,cpp}` | `DavMount`: downloads/verifies/installs a pinned `rclone` under the state dir, resolves a `--mount`/`--davmount` WebDAV entry to a ready, reused, managed FUSE mount (on-the-fly connection string, double-fork daemonize, mountinfo + active-listing readiness, failure classification), `list`/`umount` for `doos davmount`. |
 | `src/cgroup.{hpp,cpp}` | `Limits`, `Cgroup`: `doos/<name>/{main,shell}` under the user's delegated cgroup; limits on the parent, freeze on `main`, later attaches in `shell`, OOM and pid-limit counters. |
 | `src/hardening.{hpp,cpp}` | `Hardening::apply`: capability bounding set to the Docker default, seccomp-bpf denylist built at runtime (arch check, x32 guard, clone3 ENOSYS, CLONE_NEWUSER filter). |
 | `src/network.{hpp,cpp}` | `NetMode` (slirp, pasta, host, none) + `Network` (parse, resolv.conf per mode), `SlirpSession`, `PastaSession` (own the helper processes). |
 | `src/container.{hpp,cpp}` | `Options` (what the user asked for), `Container` (paths, meta, pid file, layout, one-time seeding, usage), `Store` (list, get_or_create with on-demand image fetch, remove). |
-| `src/sandbox.{hpp,cpp}` | `Sandbox`: start a container (clone + id map + mounts + pivot_root + init), watch it (size cap), or join a running one (setns). |
-| `src/cli.{hpp,cpp}` | `Cli`: argument parsing, the four container commands and `image list/add/delete`. |
+| `src/sandbox.{hpp,cpp}` | `Sandbox`: resolves davmounts (`DavMount::resolveAll`), starts a container (clone + id map + mounts + pivot_root + init), watches it (size cap), or joins a running one (setns). |
+| `src/cli.{hpp,cpp}` | `Cli`: argument parsing, the four container commands, `image list/add/delete` and `davmount list/umount`. |
 | `src/main.cpp` | Catches exceptions, prints `doos: <message>`, exit 1. |
 | `tests/run.sh` | End-to-end suite. |
 | `scripts/release.sh` | Bump, build, test, commit, tag. |
@@ -33,6 +34,7 @@ Cli::cmdAttach
     runningPid()?  yes -> join()   no -> start()
 
 start():
+  DavMount::resolveAll(mounts)    before clone: webdav entries become ready, reused Bind entries
   clone(NEWUSER|NEWNS|NEWPID|NEWUTS|NEWIPC[|NEWNET])      child = container pid 1
   IdMap::apply(child, ids)        single: write /proc maps; subuid: newuidmap + newgidmap
   slirp mode: SlirpSession.start(child)                    waits for ready-fd
@@ -86,6 +88,37 @@ unmount of the old root.
 
 Reasons are in `SPEC.md` (host root-owned files appear as `nobody`).
 
+## davmount flow
+
+```
+DavMount::resolveAll(mounts)                               (Sandbox::start, before clone)
+  for each WebDav entry:
+    id = fnv1a(url, user, pass, vendor, insecure)          dst excluded: shared across containers
+    dir = $DOOS_HOME/davmounts/<id>/, mkdirs mnt/, FileLock dir/lock
+    already in mountinfo (fuse.*) and pidfile's pid alive and an active listing succeeds?
+        -> reuse mnt/ as is (sub-second)
+        -> else unmountQuiet (fusermount3 -u, then -uz if still mounted) and fall through
+    ensureRclone(): $DOOS_HOME/tools/rclone-VERSION/rclone; `rclone version` match -> reuse,
+        else download+verify (util::fetchFile, util::verifyClearsignedSignature against the
+        pinned key, sha256 against the signed SHA256SUMS), unzip, atomic rename into place
+    rclone obscure <pass> (only if a password was given)
+    connection string ":webdav,url=\"...\",vendor=\"...\"[,user=...][,pass=...][,no_check_certificate=true]:"
+    spawnRcloneMount: pipe, fork, fork again, setsid + redirect to dir/log, execve(rclone, mount, ...)
+        first fork writes the second fork's pid down the pipe, then exits (reaped immediately);
+        the real daemon is now a child of init, outliving this doos process entirely
+    poll up to kDavMountReadyTimeoutMs: daemon pid alive? mountinfo shows it AND a real directory
+        listing succeeds (stat() alone answers without touching the backend; only listing does)?
+        -> ready, write dir/pid + dir/meta (never the password)
+        -> daemon died or never answers in time: unmountQuiet, classify dir/log's tail
+           (401/Unauthorized, x509/certificate, 501/Unsupported method, dial/host/refused/timeout,
+           else "see the log"), throw
+  Bind entries pass through unchanged; every resolved entry becomes a plain Bind MountSpec
+  pointing at dir/mnt, so mountExtra() (sandbox.cpp) never has to know davmount exists.
+```
+
+`doos davmount list`/`umount` walk/remove `$DOOS_HOME/davmounts/*` directly; `umount` is dry-run unless
+`--yes`, same pattern as `delete`/`image delete`.
+
 ## Images
 
 `ImageStore::add`: lock-free staging dir `images/.tmp-NAME`, download with curl (https only, size and time caps),