Fix CalDAV/CardDAV multiget loading entire collections into memory

A REPORT multiget for a handful of resources previously listed the
whole calendar/address book (every row incl. ical_data/vcard) and
filtered by href in Rust with an O(N×M) substring scan. Large
collections paid full-table latency, RAM and DB CPU on every sync.

- Add find_events_by_ical_uids / get_contacts_by_uids through every
  layer (domain repo trait → PG repo → storage port/adapter → use case
  → handler) using one indexed `= ANY($2)` query, mirroring the
  existing single-UID lookups.
- Extract UIDs from multiget hrefs with a shared, tested
  uid_from_multiget_href helper (percent-decoding, case-insensitive
  extension strip, collection hrefs rejected). Exact UID matching also
  removes the false positives the old substring filter allowed.
- CalDAV PROPFIND single-event path now uses the existing indexed
  get_event_by_ical_uid instead of listing all events.
- Honour the already-documented limit/offset query params on
  GET /api/address-books/{id}/contacts: optional ListQuery fields
  thread through ContactUseCase::list_contacts to a paginated repo
  query. Omitted params keep returning the full book (frontend and
  DAV listing/sync paths unchanged).

https://claude.ai/code/session_0193Hff42gaA962wThxMGSd1

src/interfaces/api/handlers/contacts_handler.rs

@@ -119,16 +119,14 @@ pub struct AddMemberRequest {
 }
 
 /// Query parameters for paginated listing.
+///
+/// Both fields are optional: when omitted, regular address books return
+/// the full contact list (the frontend relies on this), while the system
+/// book falls back to its own defaults (limit 100, offset 0).
 #[derive(Deserialize)]
 pub struct ListQuery {
-    #[serde(default = "default_limit")]
-    limit: i64,
-    #[serde(default)]
-    offset: i64,
-}
-
-fn default_limit() -> i64 {
-    100
+    limit: Option<i64>,
+    offset: Option<i64>,
 }
 
 // ── Helpers ──────────────────────────────────────────────────────────────────
@@ -455,8 +453,8 @@ pub async fn delete_address_book(
     path = "/api/address-books/{book_id}/contacts",
     params(
         ("book_id" = String, Path, description = "Address book UUID or \"system\""),
-        ("limit"   = Option<i64>, Query, description = "Max results (default 100)"),
-        ("offset"  = Option<i64>, Query, description = "Pagination offset (default 0)"),
+        ("limit"   = Option<i64>, Query, description = "Max results (omit for the full book; system book defaults to 100)"),
+        ("offset"  = Option<i64>, Query, description = "Pagination offset (omit for none; system book defaults to 0)"),
     ),
     responses(
         (status = 200, description = "List of contacts"),
@@ -488,7 +486,10 @@ pub async fn list_contacts(
             return e.into_response();
         }
         let caller_id = auth_user.id.to_string();
-        match auth_service.list_users(params.limit, params.offset).await {
+        match auth_service
+            .list_users(params.limit.unwrap_or(100), params.offset.unwrap_or(0))
+            .await
+        {
             Ok(users) => {
                 let contacts: Vec<ContactDto> = users
                     .into_iter()
@@ -505,7 +506,7 @@ pub async fn list_contacts(
     } else {
         match state
             .contact_service
-            .list_contacts(&book_id, auth_user.id)
+            .list_contacts(&book_id, params.limit, params.offset, auth_user.id)
             .await
         {
             Ok(contacts) => (StatusCode::OK, Json(contacts)).into_response(),