perf: Arc<AppState>, streaming PROPFIND, spawn_blocking SHA-256

- Issue #4: Wrap AppState in Arc — eliminates 42 Arc::clone + 16 String::clone per request
- Issue #2: Reject Depth:infinity with 403 + streaming XML with paginated DB queries
- Issue #5: Move chunked upload assembly (SHA-256 hash-on-write) to spawn_blocking
- Remove ~270 lines dead code from di.rs (unused builders, Default impl, stubs)
- Clean up unused tokio imports in chunked_upload_service.rs

src/interfaces/api/handlers/folder_handler.rs

@@ -216,7 +216,7 @@ impl FolderHandler {
     /// Both queries run concurrently via `tokio::join!`.
     /// Supports `If-None-Match` / ETag for conditional responses (304).
     pub async fn list_folder_listing(
-        State(state): State<GlobalAppState>,
+        State(state): State<Arc<GlobalAppState>>,
         auth_user: AuthUser,
         headers: HeaderMap,
         Path(id): Path<String>,
@@ -339,7 +339,7 @@ impl FolderHandler {
 
     /// Deletes a folder with trash functionality (ownership enforced by service layer)
     pub async fn delete_folder_with_trash(
-        State(state): State<GlobalAppState>,
+        State(state): State<Arc<GlobalAppState>>,
         auth_user: AuthUser,
         Path(id): Path<String>,
     ) -> impl IntoResponse {
@@ -392,7 +392,7 @@ impl FolderHandler {
 
     /// Downloads a folder as a ZIP file (ownership enforced)
     pub async fn download_folder_zip(
-        State(state): State<GlobalAppState>,
+        State(state): State<Arc<GlobalAppState>>,
         auth_user: AuthUser,
         Path(id): Path<String>,
         Query(_params): Query<HashMap<String, String>>,