perf: migrate all user/session/auth IDs from VARCHAR(36) to native UUID

- Schema: all ~15 VARCHAR(36) columns → UUID with DEFAULT gen_random_uuid()
- Domain entities: User, Session, DeviceCode, AppPassword, Share → id: Uuid
- DTOs: CurrentUser.id → Uuid (API boundary DTOs keep String for JSON)
- Auth middleware: parse JWT claims.sub (String) → Uuid at boundary
- All repository traits, port traits, service impls updated end-to-end
- Handlers: pass Uuid by value (Copy, 16 bytes) instead of String refs
- Settings chain: updated_by column → Uuid (was text, caused setup crash)
- Removed ~650 lines of String↔Uuid conversion boilerplate
- Eliminates per-request heap allocations for ID cloning
- 16-byte binary comparison vs 36-byte string comparison in all queries
- Native UUID indexing in PostgreSQL (btree on 16 bytes vs 36-char text)

85 files changed, 1090 insertions(+), 1739 deletions(-)

src/interfaces/nextcloud/ocs_handler.rs

@@ -47,7 +47,7 @@ pub async fn handle_capabilities_v2(State(state): State<Arc<AppState>>) -> Respo
 
 pub async fn handle_user_info(State(state): State<Arc<AppState>>, user: CurrentUser) -> Response {
     let quota: (i64, i64) = match state.storage_usage_service.as_ref() {
-        Some(service) => match service.get_user_storage_info(&user.id).await {
+        Some(service) => match service.get_user_storage_info(user.id).await {
             Ok((used, total)) => (used, total),
             Err(_) => (0, 0),
         },
@@ -151,7 +151,7 @@ async fn user_provisioning_response(
 
     // Fetch quota from storage usage service
     let quota: (i64, i64) = match state.storage_usage_service.as_ref() {
-        Some(service) => match service.get_user_storage_info(&user_dto.id).await {
+        Some(service) => match service.get_user_storage_info(uuid::Uuid::parse_str(&user_dto.id).unwrap_or_default()).await {
             Ok((used, total)) => (used, total),
             Err(_) => (0, 0),
         },
@@ -212,7 +212,7 @@ pub async fn handle_revoke_apppassword(
 
     if let Err(e) = nextcloud
         .app_passwords
-        .revoke_by_password(&user.id, &app_password)
+        .revoke_by_password(user.id, &app_password)
         .await
     {
         tracing::warn!("Failed to revoke app password for {}: {}", user.id, e);
@@ -367,7 +367,7 @@ pub async fn handle_search(
         ..SearchCriteriaDto::default()
     };
 
-    let results = match search_service.search(criteria, &user.id).await {
+    let results = match search_service.search(criteria, user.id).await {
         Ok(r) => r,
         Err(_) => return empty_search_response().into_response(),
     };