perf: Arc<AppState>, streaming PROPFIND, spawn_blocking SHA-256

- Issue #4: Wrap AppState in Arc — eliminates 42 Arc::clone + 16 String::clone per request
- Issue #2: Reject Depth:infinity with 403 + streaming XML with paginated DB queries
- Issue #5: Move chunked upload assembly (SHA-256 hash-on-write) to spawn_blocking
- Remove ~270 lines dead code from di.rs (unused builders, Default impl, stubs)
- Clean up unused tokio imports in chunked_upload_service.rs

src/application/ports/file_ports.rs

@@ -170,6 +170,20 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
     ) -> Result<Vec<FileDto>, DomainError> {
         self.list_files(Some(folder_id)).await
     }
+
+    /// Lists files in a folder with LIMIT/OFFSET pagination.
+    ///
+    /// Used by streaming WebDAV PROPFIND to avoid loading all files at once.
+    /// Default: falls back to `list_files` (loads all, then slices in memory).
+    async fn list_files_batch(
+        &self,
+        folder_id: Option<&str>,
+        offset: i64,
+        limit: i64,
+    ) -> Result<Vec<FileDto>, DomainError> {
+        let all = self.list_files(folder_id).await?;
+        Ok(all.into_iter().skip(offset as usize).take(limit as usize).collect())
+    }
 }
 
 // ─────────────────────────────────────────────────────