iOS CardDAV always normalizes to principal and syncs system addressbooks (even if disabled)

Describe the bug

• iOS shows multiple addressbooks → duplicate contacts appear if the same number exists in more than one addressbook
• Incoming calls show multiple contact matches → very confusing for end users
• "Disabled" system addressbooks in Nextcloud still remain active over DAV and cannot be hidden

Steps to reproduce

1. Create a new user in Nextcloud
2. Open Contacts app in Nextcloud → disable the "System addressbook"
3. Configure CardDAV on iOS with the addressbook URL of a specific contacts book
4. iOS rewrites the server URL to /principal/ and syncs all addressbooks anyway

Expected behavior

When disabling the "System addressbook" (or other unused default addressbooks) in Nextcloud, they should not be exposed via DAV anymore. iOS devices should only sync the addressbooks that are enabled by the user.

Actual behavior

On iOS (tested with iOS 18.4), when setting up a CardDAV account using a specific addressbook URL like:
https://cloud.example.com/remote.php/dav/addressbooks/users/hanne/kontakte/

the system automatically rewrites the server URL to:
https://cloud.example.com/remote.php/dav/principals/users/hanne/

This causes all available addressbooks (including the "System addressbook" and any other inactive ones) to be synced to iOS.
Even if the system addressbook is marked as disabled in the Nextcloud web UI, it still shows up in the DAV response and iOS pulls it in.

Contact version

7.2.5

Operating system

Nextcloud Hub 10 (31.0.4)

PHP engine version

PHP 8.3

Web server

Nginx

Database

MySQL

Feature request

It should be possible to completely disable system addressbooks (or other addressbooks) also on DAV level, so they are no longer exposed to CardDAV clients.
This would prevent iOS from syncing unwanted/empty addressbooks and avoid duplicates.

Start by tracing the CardDAV response for /remote.php/dav/principals/users/hanne/ and the addressbook URL shown in the report. Check how disabled system addressbooks are represented in DAV, then verify that a disabled book is absent from the response while enabled books remain available. Reproduce with iOS 18.4 or inspect the DAV output to confirm the result.