perf: migrate all user/session/auth IDs from VARCHAR(36) to native UUID

- Schema: all ~15 VARCHAR(36) columns → UUID with DEFAULT gen_random_uuid()
- Domain entities: User, Session, DeviceCode, AppPassword, Share → id: Uuid
- DTOs: CurrentUser.id → Uuid (API boundary DTOs keep String for JSON)
- Auth middleware: parse JWT claims.sub (String) → Uuid at boundary
- All repository traits, port traits, service impls updated end-to-end
- Handlers: pass Uuid by value (Copy, 16 bytes) instead of String refs
- Settings chain: updated_by column → Uuid (was text, caused setup crash)
- Removed ~650 lines of String↔Uuid conversion boilerplate
- Eliminates per-request heap allocations for ID cloning
- 16-byte binary comparison vs 36-byte string comparison in all queries
- Native UUID indexing in PostgreSQL (btree on 16 bytes vs 36-char text)

85 files changed, 1090 insertions(+), 1739 deletions(-)

src/domain/repositories/user_repository.rs

@@ -1,5 +1,6 @@
 use crate::common::errors::DomainError;
 use crate::domain::entities::user::{User, UserRole};
+use uuid::Uuid;
 
 #[derive(Debug, thiserror::Error)]
 pub enum UserRepositoryError {
@@ -45,7 +46,7 @@ pub trait UserRepository: Send + Sync + 'static {
     async fn create_user(&self, user: User) -> UserRepositoryResult<User>;
 
     /// Gets a user by ID
-    async fn get_user_by_id(&self, id: &str) -> UserRepositoryResult<User>;
+    async fn get_user_by_id(&self, id: Uuid) -> UserRepositoryResult<User>;
 
     /// Gets a user by username
     async fn get_user_by_username(&self, username: &str) -> UserRepositoryResult<User>;
@@ -59,12 +60,12 @@ pub trait UserRepository: Send + Sync + 'static {
     /// Updates only a user's storage usage
     async fn update_storage_usage(
         &self,
-        user_id: &str,
+        user_id: Uuid,
         usage_bytes: i64,
     ) -> UserRepositoryResult<()>;
 
     /// Updates the last login date
-    async fn update_last_login(&self, user_id: &str) -> UserRepositoryResult<()>;
+    async fn update_last_login(&self, user_id: Uuid) -> UserRepositoryResult<()>;
 
     /// Lists users with pagination
     async fn list_users(&self, limit: i64, offset: i64) -> UserRepositoryResult<Vec<User>>;
@@ -73,21 +74,21 @@ pub trait UserRepository: Send + Sync + 'static {
     async fn search_users(&self, query: &str, limit: i64) -> UserRepositoryResult<Vec<User>>;
 
     /// Activates or deactivates a user
-    async fn set_user_active_status(&self, user_id: &str, active: bool)
+    async fn set_user_active_status(&self, user_id: Uuid, active: bool)
     -> UserRepositoryResult<()>;
 
     /// Changes a user's password
-    async fn change_password(&self, user_id: &str, password_hash: &str)
+    async fn change_password(&self, user_id: Uuid, password_hash: &str)
     -> UserRepositoryResult<()>;
 
     /// Changes a user's role
-    async fn change_role(&self, user_id: &str, role: UserRole) -> UserRepositoryResult<()>;
+    async fn change_role(&self, user_id: Uuid, role: UserRole) -> UserRepositoryResult<()>;
 
     /// Lists users by role (admin or user)
     async fn list_users_by_role(&self, role: &str) -> UserRepositoryResult<Vec<User>>;
 
     /// Deletes a user
-    async fn delete_user(&self, user_id: &str) -> UserRepositoryResult<()>;
+    async fn delete_user(&self, user_id: Uuid) -> UserRepositoryResult<()>;
 
     /// Finds a user by OIDC provider + subject pair
     async fn get_user_by_oidc_subject(
@@ -99,7 +100,7 @@ pub trait UserRepository: Send + Sync + 'static {
     /// Updates a user's storage quota
     async fn update_storage_quota(
         &self,
-        user_id: &str,
+        user_id: Uuid,
         quota_bytes: i64,
     ) -> UserRepositoryResult<()>;