perf: migrate all user/session/auth IDs from VARCHAR(36) to native UUID

- Schema: all ~15 VARCHAR(36) columns → UUID with DEFAULT gen_random_uuid()
- Domain entities: User, Session, DeviceCode, AppPassword, Share → id: Uuid
- DTOs: CurrentUser.id → Uuid (API boundary DTOs keep String for JSON)
- Auth middleware: parse JWT claims.sub (String) → Uuid at boundary
- All repository traits, port traits, service impls updated end-to-end
- Handlers: pass Uuid by value (Copy, 16 bytes) instead of String refs
- Settings chain: updated_by column → Uuid (was text, caused setup crash)
- Removed ~650 lines of String↔Uuid conversion boilerplate
- Eliminates per-request heap allocations for ID cloning
- 16-byte binary comparison vs 36-byte string comparison in all queries
- Native UUID indexing in PostgreSQL (btree on 16 bytes vs 36-char text)

85 files changed, 1090 insertions(+), 1739 deletions(-)

src/interfaces/api/handlers/app_password_handler.rs

@@ -11,6 +11,7 @@ use axum::extract::State;
 use axum::routing::{delete, get, post};
 use axum::{Json, Router};
 use std::sync::Arc;
+use uuid::Uuid;
 
 /// Protected routes — require JWT auth middleware.
 pub fn app_password_routes() -> Router<Arc<AppState>> {
@@ -35,7 +36,7 @@ async fn create_app_password(
         .ok_or_else(|| AppError::internal_error("App password service not configured"))?;
 
     let response = service
-        .create(&user.id, request)
+        .create(user.id, request)
         .await
         .map_err(AppError::from)?;
 
@@ -55,7 +56,7 @@ async fn list_app_passwords(
         .as_ref()
         .ok_or_else(|| AppError::internal_error("App password service not configured"))?;
 
-    let response = service.list(&user.id).await.map_err(AppError::from)?;
+    let response = service.list(user.id).await.map_err(AppError::from)?;
 
     Ok(Json(response))
 }
@@ -72,8 +73,10 @@ async fn revoke_app_password(
         .as_ref()
         .ok_or_else(|| AppError::internal_error("App password service not configured"))?;
 
+    let id = Uuid::parse_str(&id).map_err(|_| AppError::bad_request("Invalid UUID"))?;
+
     let response = service
-        .revoke(&user.id, &id)
+        .revoke(user.id, id)
         .await
         .map_err(AppError::from)?;