Feature Accept Bearer / OIDC tokens on WebDAV

Self Checks

• I have read the Contributing Guide and Language Policy.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed. / 请使用英语提交，否则会被关闭。
• Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

We use Cloudreve Pro with an external OpenID Connect IdP (Keycloak) so the web UI can SSO. That part works.

The problem is /dav. WebDAVAuth only accepts HTTP Basic against a separate DAV account (GetActiveByDavAccount). It does not accept:

• Authorization: Bearer <Cloudreve access token> (the JWT already used by /api/v4)
• Authorization: Bearer <IdP access token> from the configured OIDC provider

So after a user signs in via OIDC, a WebDAV client (rclone, ChromeOS Files / fileSystemProvider, davfs2, desktop sync) still needs a second, Cloudreve-generated password. OIDC-only users have no password to give those clients. Dedicated DAV passwords also end up in OS keychains and cannot participate in SSO / token refresh / IdP session logout.

Related existing issues are about web OIDC (#2111, #3056) or Cloudreve-as-OIDC-provider (#3464), not WebDAV accepting tokens.

2. Additional context or comments

Ask: keep Basic DAV accounts as they are, and additionally authenticate WebDAV when Authorization: Bearer ... is present.

Suggested order of acceptance:

1. Cloudreve API access tokens (same JWT as Authorization: Bearer on /api/v4). This unblocks any client that can already complete Cloudreve OAuth / session login.
2. If OIDC login is enabled, accept the IdP access token (JWKS / userinfo / introspection, mapped to the same Cloudreve user as web OIDC). This is what rclone bearer_token / bearer_token_command and OpenCloud / ownCloud OIDC WebDAV already do.

Example:

PROPFIND /dav/ HTTP/1.1
Authorization: Bearer <access_token>
Depth: 1

Prior art: ownCloud OpenID Connect app (OpenIdSabreAuthBackend), OpenCloud/oCIS WebDAV Bearer, Nextcloud user_oidc Bearer for APIs.

Happy to test against Keycloak if this is implemented.

### 3. Can you help us with this feature?

- [x] I am interested in contributing to this feature.