[BryanFRD]

Adds a cargo-fuzz crate under fuzz/ and a nightly workflow calling the shared reusable.

Targets:

• node_path: parse_path never yields a segment with a separator, ./.., a control character or more than 255 bytes, and re-parsing the joined result is stable.
• rel_path: RelPath::parse is idempotent and to_path stays inside its root with only normal components.
• range_plan: ranges::plan never returns a partial range with start > end or end >= size.
• propfind: PROPFIND body parsing does not panic on arbitrary XML.
• lock_headers: If, Lock-Token and Timeout parsing returns only tokens present in the header and a positive timeout.

dav::propfind is now pub mod so the target can reach it; no behavior change.

Ran each target for 60 s locally (0.9M to 3.5M executions each), no findings.

[ferrfleet-interne]

Approve: the fuzz targets only use public APIs, and every assertion I checked against the parsers holds. Nothing blocking.

[ferrfleet-interne]

Ready to merge. The code review found no issues, and formal verification failed to run, so there is no result from it.

Review

This PR adds five cargo-fuzz targets (node paths, RelPath, Range planning, PROPFIND bodies, lock headers) and a nightly workflow (.github/workflows/fuzz.yml). The only production change is api/src/dav/mod.rs:5, which makes dav::propfind public so the fuzz target can call it. Every target uses public APIs. The reviewer checked each assertion against the parser source and found they hold. No findings.

Formal verification

The formal-verify step failed and returned no result. No properties were checked, and this is not evidence either way.