perf: round 12 — auth write-path narrowing, fused quota gate, moka blob-cache index, media single-read, sized listing JSON

Benchmark-gated round (benches/ROUND12.md; every change ships with a
BEFORE/AFTER harness + equivalence gates, one candidate rejected by its
own bench):

DB / query shapes (bench_round12_queries):
- NC sharee search: username-only projection instead of the 21-column row
  (incl. the <=512 KiB avatar) per match, + gin_trgm_ops indexes on
  auth.users for the leading-wildcard ILIKE (4.98x; 54.7x with index).
- Password login: delete the redundant full-row update_user — create_session
  already stamps last_login_at in its own txn (4.45x per login).
- Email-verified stamp: narrow conditional UPDATE (8.9x); OIDC repeat login
  now compares profile state in memory and issues ZERO queries when nothing
  changed (was: full 17-column rewrite per login).
- Refresh rotation: revoke+insert+stamp fused into one transaction via new
  rotate_session port method (1.18x).
- WOPI CheckFileInfo / authorize_wopi_access: require(Read) + get_file +
  check(Update) overlapped with tokio::join!, original result precedence
  (cold 1.34x).
- Upload quota gate: user-envelope + drive-cap checks fused into ONE
  round-trip (check_upload_quotas) — the NC chunked PUT pays this per
  chunk (1.81x, 2 -> 1 queries/chunk); shared verdict evaluators keep
  error shapes byte-identical.

CPU / allocs (bench_round12_micro):
- sized_json: pre-sized listing serialization replacing axum Json's 128 B
  seed + doubling-realloc chain on files/folder-resources/photos/search
  responses (1.40x, 13 -> 2 allocs per 500-row page; byte-identical).
- Security headers: 4 SetResponseHeaderLayer folded into the CSP middleware
  pass (5 layers -> 1; 1.43x per request, -26 allocs; header set gated
  byte-identical incl. 304s).
- Media capture-metadata: single-read extraction — nom-exif now parses the
  buffer kamadak already read (zero-copy Bytes) and videos open once with a
  kind() dispatch; per-image opens 2-3 -> 1 (1.44x warm geomean, 1.6-3.2x
  cold cache; extraction outputs gated identical incl. the MIME-mislabel
  track fallback).
- Chunked-upload session ops: owner gate folded into the operation's own
  DashMap lookup + stack-encoded uuid compare (5 -> 3 lookups, -2 allocs,
  1.28x per chunk).

Blob cache (bench_blob_cache_index + round-3 regression guard):
- CachedBlobBackend index: tokio::sync::Mutex<LruCache> -> moka::sync::Cache
  with byte weigher. The mutex serialized every cached chunk read and scaled
  NEGATIVELY (2.08 -> 1.07 Mops/s from 1 -> 2 readers); moka probes are
  lock-free (2.17x at K=2). Byte budget now enforced by moka (manual
  current_size + collect_evictions machinery deleted); eviction listener
  unlinks size-evicted files only (Replaced entries keep their file —
  gated). Single-flight miss gate unchanged (16 concurrent misses -> 1
  fetch re-verified via the round-3 harness).
- put_blob now populates the cache BEFORE the inner backend consumes the
  source file (the old order failed 100% of the time — local renames,
  S3/Azure delete the source — so the first read after a whole-file put
  re-downloaded from the remote); inner-put failure invalidates the entry.

Frontend (vitest gates):
- List-view thumbnails request the 150px icon rendition instead of 400px
  preview into a 40px slot (~7.1x fewer pixels, ~4-5x fewer bytes per
  thumbnail across list views); grid keeps preview.

Rejected by its own bench (kept as evidence in bench_round12_micro §2):
- Single-pass compression predicate: the monomorphized And-chain already
  costs ~4.6 ns / 0 allocs total; the fused node measured within noise.

New migration: 20260719000000_users_search_trgm.sql (trgm indexes).
Deferred with prepared design: grouped file/grid view virtualization
(single-VirtualRows flatten, the photos pattern) — next round's headline.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfidAJD5AHw23jtvBUNamB

src/infrastructure/services/chunked_upload_service.rs

@@ -514,6 +514,17 @@ impl ChunkedUploadService {
         Ok(())
     }
 
+    /// Alloc-free owner compare for the per-chunk hot path: the caller's
+    /// `Uuid` is stack-encoded (hyphenated, the format sessions store) —
+    /// `prepare_chunk`/`commit_chunk` used to pay a `Uuid::to_string` each
+    /// plus a dedicated `verify_session_owner` map lookup per chunk
+    /// (benches/ROUND12.md §M5, 1.28x / −2 allocs per chunk).
+    #[inline]
+    fn owner_matches(session_user_id: &str, user_id: Uuid) -> bool {
+        let mut buf = [0u8; 36];
+        session_user_id == user_id.hyphenated().encode_lower(&mut buf) as &str
+    }
+
     /// Create a new upload session (persists `session.json` + empty `progress.bin`)
     async fn create_session_inner(
         &self,
@@ -617,9 +628,8 @@ impl ChunkedUploadService {
         user_id: Uuid,
         chunk_index: usize,
     ) -> Result<(PathBuf, usize), DomainError> {
-        self.verify_session_owner(upload_id, &user_id.to_string())
-            .map_err(|e| DomainError::new(ErrorKind::NotFound, "ChunkedUpload", e))?;
-
+        // Single map lookup: the owner gate rides the same guard (same
+        // anti-enum not-found for unknown session and foreign session).
         let session = self.sessions.get(upload_id).ok_or_else(|| {
             DomainError::new(
                 ErrorKind::NotFound,
@@ -627,6 +637,13 @@ impl ChunkedUploadService {
                 format!("Upload session not found: {}", upload_id),
             )
         })?;
+        if !Self::owner_matches(&session.user_id, user_id) {
+            return Err(DomainError::new(
+                ErrorKind::NotFound,
+                "ChunkedUpload",
+                format!("Upload session not found: {}", upload_id),
+            ));
+        }
 
         if chunk_index >= session.chunks.len() {
             return Err(DomainError::new(
@@ -678,20 +695,23 @@ impl ChunkedUploadService {
         computed_checksum: Option<String>,
         expected_checksum: Option<String>,
     ) -> Result<ChunkUploadResponseDto, DomainError> {
-        self.verify_session_owner(upload_id, &user_id.to_string())
-            .map_err(|e| DomainError::new(ErrorKind::NotFound, "ChunkedUpload", e))?;
-
-        // Re-fetch chunk metadata under fresh lock — guards against the
-        // (vanishingly unlikely) case of a session expiry / cancellation
-        // racing with the write.
+        // Owner gate folded into the metadata read below — one lookup
+        // instead of two, same anti-enum not-found semantics.
         let (chunk_path, expected_size, persist_path) = {
             let session = self.sessions.get(upload_id).ok_or_else(|| {
                 DomainError::new(
                     ErrorKind::NotFound,
                     "ChunkedUpload",
-                    "Session disappeared".to_string(),
+                    format!("Upload session not found: {}", upload_id),
                 )
             })?;
+            if !Self::owner_matches(&session.user_id, user_id) {
+                return Err(DomainError::new(
+                    ErrorKind::NotFound,
+                    "ChunkedUpload",
+                    format!("Upload session not found: {}", upload_id),
+                ));
+            }
             if chunk_index >= session.chunks.len() {
                 return Err(DomainError::new(
                     ErrorKind::InvalidInput,