Fix CalDAV/CardDAV multiget loading entire collections into memory

A REPORT multiget for a handful of resources previously listed the
whole calendar/address book (every row incl. ical_data/vcard) and
filtered by href in Rust with an O(N×M) substring scan. Large
collections paid full-table latency, RAM and DB CPU on every sync.

- Add find_events_by_ical_uids / get_contacts_by_uids through every
  layer (domain repo trait → PG repo → storage port/adapter → use case
  → handler) using one indexed `= ANY($2)` query, mirroring the
  existing single-UID lookups.
- Extract UIDs from multiget hrefs with a shared, tested
  uid_from_multiget_href helper (percent-decoding, case-insensitive
  extension strip, collection hrefs rejected). Exact UID matching also
  removes the false positives the old substring filter allowed.
- CalDAV PROPFIND single-event path now uses the existing indexed
  get_event_by_ical_uid instead of listing all events.
- Honour the already-documented limit/offset query params on
  GET /api/address-books/{id}/contacts: optional ListQuery fields
  thread through ContactUseCase::list_contacts to a paginated repo
  query. Omitted params keep returning the full book (frontend and
  DAV listing/sync paths unchanged).

https://claude.ai/code/session_0193Hff42gaA962wThxMGSd1

src/application/adapters/mod.rs

@@ -8,3 +8,91 @@ pub mod webdav_adapter;
 mod caldav_adapter_test;
 #[cfg(test)]
 mod carddav_adapter_test;
+
+/// Extract the resource UID from a DAV multiget `href`.
+///
+/// CalDAV/CardDAV multiget REPORTs address object resources by full href
+/// (e.g. `/caldav/{calendar_id}/{uid}.ics`, possibly with a username
+/// segment). The UID is the last path segment with the protocol
+/// `extension` (`.ics` / `.vcf`, matched case-insensitively) stripped,
+/// then percent-decoded — hrefs arrive in the XML body, so they have not
+/// gone through URL-path decoding, and clients may re-encode hrefs they
+/// previously read from the server.
+///
+/// Returns `None` for collection hrefs (empty last segment) or segments
+/// that are not valid UTF-8 after decoding.
+pub fn uid_from_multiget_href(href: &str, extension: &str) -> Option<String> {
+    // A trailing slash denotes a collection, not an object resource.
+    if href.ends_with('/') {
+        return None;
+    }
+    let segment = href.rsplit('/').next()?;
+
+    // Case-insensitive ASCII extension strip; the matched tail is ASCII,
+    // so the byte cut is guaranteed to land on a char boundary.
+    let bytes = segment.as_bytes();
+    let ext = extension.as_bytes();
+    let segment =
+        if bytes.len() >= ext.len() && bytes[bytes.len() - ext.len()..].eq_ignore_ascii_case(ext) {
+            &segment[..segment.len() - ext.len()]
+        } else {
+            segment
+        };
+
+    let decoded = percent_encoding::percent_decode_str(segment)
+        .decode_utf8()
+        .ok()?;
+    let uid = decoded.trim();
+    (!uid.is_empty()).then(|| uid.to_string())
+}
+
+#[cfg(test)]
+mod multiget_href_tests {
+    use super::uid_from_multiget_href;
+
+    #[test]
+    fn plain_caldav_href() {
+        assert_eq!(
+            uid_from_multiget_href("/caldav/abc-123/event-uid.ics", ".ics"),
+            Some("event-uid".to_string())
+        );
+    }
+
+    #[test]
+    fn href_with_username_prefix() {
+        assert_eq!(
+            uid_from_multiget_href("/carddav/alice/book-1/uid-42.vcf", ".vcf"),
+            Some("uid-42".to_string())
+        );
+    }
+
+    #[test]
+    fn uppercase_extension() {
+        assert_eq!(
+            uid_from_multiget_href("/caldav/abc/EVENT.ICS", ".ics"),
+            Some("EVENT".to_string())
+        );
+    }
+
+    #[test]
+    fn percent_encoded_uid() {
+        assert_eq!(
+            uid_from_multiget_href("/caldav/abc/uid%40example.com.ics", ".ics"),
+            Some("uid@example.com".to_string())
+        );
+    }
+
+    #[test]
+    fn missing_extension_uses_whole_segment() {
+        assert_eq!(
+            uid_from_multiget_href("/caldav/abc/bare-uid", ".ics"),
+            Some("bare-uid".to_string())
+        );
+    }
+
+    #[test]
+    fn collection_href_yields_none() {
+        assert_eq!(uid_from_multiget_href("/caldav/abc/", ".ics"), None);
+        assert_eq!(uid_from_multiget_href("", ".ics"), None);
+    }
+}