perf: round 11 — StoragePath joined-only, classifier fusion, memoized bodies, query-shape pack, SPA fine-grained stars

Backend (each change benchmark-gated with BEFORE replicas + equivalence
gates; see examples/bench_round11_micro.rs, bench_round11_queries.rs,
bench_log_writer.rs and benches/ROUND11.md — final numbers land in the
follow-up doc commit):

- StoragePath re-representation: single canonical joined String, segments
  derived on demand; File/Folder drop the duplicated path_string field
  (4000→1000 allocs per 500-row listing page)
- Display classifier fusion: classify_display shares one stack-lowered
  extension across the three decision trees; call sites in FileDto,
  folder/favorites/recent handlers, trash, path-resolver (+ interning
  where Arc::from was still used)
- /status.php and /openapi.json memoized into OnceLock<Bytes> (openapi
  rebuilt a 171 KiB spec per request: 2.8 ms → 18 ns)
- NC upload-session PROPFIND: write! + pre-sized body + stack RFC2822
  dates (2.3-2.6x, 2582→772 allocs at 256 chunks)
- REST download: dead FileDto clone removed (capture mime/size + move)
- CalendarEventDto/TrashedItem into_parts moves (11 KiB ical_data memcpy
  gone per CalDAV row); CardDAV getlastmodified stack render
- 4xx path: borrowed ErrorResponse serialize, ErrorKind::as_str,
  not_found/already_exists clone kill
- vCard emit via write!; search page moved out with into_iter skip/take;
  content-hit UUIDs parsed once; group last-user check via HashSet
- RateLimiter: lock-free get + insert (and_upsert_with variant REJECTED
  by benchmark); CSRF token borrow-compare + borrowed cookie extraction
- Thumbnail/preview ETags built from as_str (Debug-identical bytes)
- Encrypted backend: encrypt_in_place_detached single-buffer write path,
  chunk-sized reserve in collect_stream; retry labels made lazy
- PG: deferred upload registration 3→1 round-trips (persist_file CTE
  template); direct_grant_cache for Calendar/AddressBook/Playlist authz
  (single-flight + set_role/clear_role invalidation); expand_user
  tokio::join!; geo clusters min(uuid)::text; recluster face assignment
  batched into one UNNEST update
- People recluster cosine: norms precomputed once (bit-identical gate)
- NC capabilities poll logs demoted to debug; tracing-appender dep added
  for the log-writer benchmark

Frontend:
- ResourceList.selectedEntries O(N)-per-toggle → id-index projection
  O(k log k); favorites/recent consume the batchToolbar snippet param and
  drop their duplicate filter + dead selectedIds mirror
- Recent: star state via new favoriteIds prop — a star click no longer
  rebuilds all N entries
- admin timeAgo >30d fallback uses the cached Intl.DateTimeFormat
- vitest gates in src/lib/components/round11.bench.test.ts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ABhTEHuGujvwoodh67Kga7

src/interfaces/api/handlers/file_handler.rs

@@ -404,7 +404,18 @@ impl FileHandler {
         // (file_id, size, format) triple.  If the browser already has it, return
         // 304 with zero I/O or DB work. Format is in the ETag so a client that
         // switched codecs doesn't get a stale 304.
-        let etag = format!("\"thumb-{}-{:?}-{:?}\"", id, thumb_size, format);
+        let etag = {
+            let (s, f) = (thumb_size.as_str(), format.as_str());
+            let mut e = String::with_capacity(9 + id.len() + s.len() + f.len());
+            e.push_str("\"thumb-");
+            e.push_str(&id);
+            e.push('-');
+            e.push_str(s);
+            e.push('-');
+            e.push_str(f);
+            e.push('"');
+            e
+        };
         if let Some(if_none_match) = headers.get(header::IF_NONE_MATCH)
             && let Ok(val) = if_none_match.to_str()
             && (val == etag || val == "*")
@@ -776,9 +787,15 @@ impl FileHandler {
 
         // Use the ownership-scoped optimized download.
         // Ownership was already verified by get_file_owned above,
-        // so we can safely use the preloaded variant.
+        // so we can safely use the preloaded variant. Capture the two
+        // fields the stream arm needs (one Arc bump + a u64 copy) and MOVE
+        // the DTO in — the old `file_dto.clone()` deep-copied all 7 owned
+        // Strings on every download, purely to read mime/size afterwards
+        // (benches/ROUND11.md §1).
+        let dto_mime = file_dto.mime_type.clone();
+        let dto_size = file_dto.size;
         match retrieval
-            .get_file_optimized_preloaded(&id, file_dto.clone(), accept_webp, prefer_original)
+            .get_file_optimized_preloaded(&id, file_dto, accept_webp, prefer_original)
             .await
         {
             Ok((_file, content)) => match content {
@@ -788,9 +805,9 @@ impl FileHandler {
                     .into_response(),
                 OptimizedFileContent::Stream(pinned_stream) => Response::builder()
                     .status(StatusCode::OK)
-                    .header(header::CONTENT_TYPE, &*file_dto.mime_type)
+                    .header(header::CONTENT_TYPE, &*dto_mime)
                     .header(header::CONTENT_DISPOSITION, &disposition)
-                    .header(header::CONTENT_LENGTH, file_dto.size)
+                    .header(header::CONTENT_LENGTH, dto_size)
                     .header(header::ETAG, &etag)
                     .header(
                         header::CACHE_CONTROL,