perf: Arc<AppState>, streaming PROPFIND, spawn_blocking SHA-256

- Issue #4: Wrap AppState in Arc — eliminates 42 Arc::clone + 16 String::clone per request
- Issue #2: Reject Depth:infinity with 403 + streaming XML with paginated DB queries
- Issue #5: Move chunked upload assembly (SHA-256 hash-on-write) to spawn_blocking
- Remove ~270 lines dead code from di.rs (unused builders, Default impl, stubs)
- Clean up unused tokio imports in chunked_upload_service.rs

src/interfaces/web/mod.rs

@@ -2,12 +2,13 @@ use crate::common::config::AppConfig;
 use crate::common::di::AppState;
 use axum::http::header::{CACHE_CONTROL, HeaderValue};
 use axum::{Router, response::Html, routing::get};
+use std::sync::Arc;
 use tower_http::compression::CompressionLayer;
 use tower_http::services::ServeDir;
 use tower_http::set_header::SetResponseHeaderLayer;
 
 /// Creates web routes for serving static files
-pub fn create_web_routes() -> Router<AppState> {
+pub fn create_web_routes() -> Router<Arc<AppState>> {
     // Get config to access static path
     let config = AppConfig::from_env();
     let static_path = config.static_path.clone();