perf: Arc<AppState>, streaming PROPFIND, spawn_blocking SHA-256

- Issue #4: Wrap AppState in Arc — eliminates 42 Arc::clone + 16 String::clone per request
- Issue #2: Reject Depth:infinity with 403 + streaming XML with paginated DB queries
- Issue #5: Move chunked upload assembly (SHA-256 hash-on-write) to spawn_blocking
- Remove ~270 lines dead code from di.rs (unused builders, Default impl, stubs)
- Clean up unused tokio imports in chunked_upload_service.rs

src/application/ports/file_ports.rs

@@ -170,6 +170,20 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
     ) -> Result<Vec<FileDto>, DomainError> {
         self.list_files(Some(folder_id)).await
     }
+
+    /// Lists files in a folder with LIMIT/OFFSET pagination.
+    ///
+    /// Used by streaming WebDAV PROPFIND to avoid loading all files at once.
+    /// Default: falls back to `list_files` (loads all, then slices in memory).
+    async fn list_files_batch(
+        &self,
+        folder_id: Option<&str>,
+        offset: i64,
+        limit: i64,
+    ) -> Result<Vec<FileDto>, DomainError> {
+        let all = self.list_files(folder_id).await?;
+        Ok(all.into_iter().skip(offset as usize).take(limit as usize).collect())
+    }
 }
 
 // ─────────────────────────────────────────────────────

src/application/ports/storage_ports.rs

@@ -78,6 +78,22 @@ pub trait FileReadPort: Send + Sync + 'static {
         Ok(None)
     }
 
+    /// Lists files in a folder with LIMIT/OFFSET pagination.
+    ///
+    /// Used by streaming WebDAV PROPFIND to avoid loading all files at once.
+    /// Default: falls back to `list_files` (loads all, then slices in memory).
+    async fn list_files_batch(
+        &self,
+        folder_id: Option<&str>,
+        offset: i64,
+        limit: i64,
+    ) -> Result<Vec<File>, DomainError> {
+        let all = self.list_files(folder_id).await?;
+        let start = (offset as usize).min(all.len());
+        let end = (start + limit as usize).min(all.len());
+        Ok(all.into_iter().skip(start).take(end - start).collect())
+    }
+
     /// Lists every file in the subtree rooted at `folder_id`.
     ///
     /// Uses an ltree `<@` join against `storage.folders` so the entire