perf: Arc<AppState>, streaming PROPFIND, spawn_blocking SHA-256

- Issue #4: Wrap AppState in Arc — eliminates 42 Arc::clone + 16 String::clone per request
- Issue #2: Reject Depth:infinity with 403 + streaming XML with paginated DB queries
- Issue #5: Move chunked upload assembly (SHA-256 hash-on-write) to spawn_blocking
- Remove ~270 lines dead code from di.rs (unused builders, Default impl, stubs)
- Clean up unused tokio imports in chunked_upload_service.rs

src/interfaces/api/handlers/wopi_handler.rs

@@ -30,7 +30,7 @@ pub struct WopiState {
     pub token_service: Arc<WopiTokenService>,
     pub lock_service: Arc<WopiLockService>,
     pub discovery_service: Arc<WopiDiscoveryService>,
-    pub app_state: crate::common::di::AppState,
+    pub app_state: Arc<crate::common::di::AppState>,
     /// Public base URL for host page origin and postMessage origin
     pub public_base_url: String,
     /// Base URL used for WOPISrc callbacks from Collabora to OxiCloud
@@ -506,8 +506,8 @@ async fn get_supported_extensions(State(state): State<WopiState>) -> Response {
 pub fn wopi_routes(
     wopi_state: WopiState,
 ) -> (
-    Router<crate::common::di::AppState>,
-    Router<crate::common::di::AppState>,
+    Router<Arc<crate::common::di::AppState>>,
+    Router<Arc<crate::common::di::AppState>>,
 ) {
     let protocol_router = Router::new()
         // CheckFileInfo