Unable to verify account name or password

Describe the bug

When setting up a CardDAV account on MacOS, one gets:
"Unable to verify account name or password."

Username and password are correct, no typo.

Steps to reproduce

1. Setup Nextcloud, Contacts app and user account /
   Nextcloud runs in a subdirectory https://<server.domain>/nextcloud
2. on MacOS setup a CardDAV account
   Server Address: <server.domain>
   Server Path: /nextcloud/remote.php/dav/addressbooks/users//contacts-1
   Port: 443, [x] Use SSL
3. Sign In

-> This leads to above mentioned error message, account gets created but no access is possible.

Expected behavior

Setup connection
Use Contacts
(as easy as that)

Actual behavior

Cannot connect CardDAV connector for MacOS (or IOS for that).

Contact version

7.0.1

Operating system

Synology

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database

MariaDB

Additional info

updated .htaccess to rewrite caldav and carddav paths

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
...

<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteCond %{HTTP_USER_AGENT} DavClnt
  RewriteRule ^$ /remote.php/webdav/ [L,R=302]
  RewriteRule .* - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
#  RewriteRule ^\.well-known/carddav /remote.php/dav/ [R=301,L]
#  RewriteRule ^\.well-known/caldav /remote.php/dav/ [R=301,L]
  RewriteRule ^\.well-known/carddav /nextcloud/remote.php/dav/ [R=301,L]
  RewriteRule ^\.well-known/caldav /nextcloud/remote.php/dav/ [R=301,L]
  RewriteRule ^remote/(.*) remote.php [QSA,L]
  RewriteRule ^(?:build|tests|config|lib|3rdparty|templates)/.* - [R=404,L]
  RewriteRule ^\.well-known/(?!acme-challenge|pki-validation) /index.php [QSA,L]
  RewriteRule ^ocm-provider/?$ index.php [QSA,L]
  RewriteRule ^(?:\.(?!well-known)|autotest|occ|issue|indie|db_|console).* - [R=404,L]
</IfModule>

Start with the .htaccess rewrite block shown in the report, especially the .well-known/carddav and .well-known/caldav redirects and Authorization rule. Reproduce the MacOS CardDAV setup against the /nextcloud path and inspect whether the redirected endpoint receives authentication; done means the account connects and Contacts is usable.