perf: findings 6.1, 6.2, 2.6 — async Argon2, moka cache, full streaming migration

- 6.1: PasswordHasherPort now async_trait with spawn_blocking for Argon2
- 6.2: OIDC pending maps migrated from std::sync::Mutex to moka::sync::Cache with TTL
- 2.6: All file download paths migrated to 64KB streaming (get_file_stream / read_blob_stream)
  - WOPI, dedup, batch ZIP, file_retrieval_service consumers migrated
  - WebDAV COPY uses zero-copy dedup (copy_file)
  - Removed dead code: get_file_content, get_file_mmap, read_blob, read_blob_bytes
    from traits, impls, stubs, and mocks (18 files touched)

src/application/ports/auth_ports.rs

@@ -11,12 +11,16 @@ use async_trait::async_trait;
 ///
 /// This trait abstracts cryptographic password operations, allowing the domain
 /// layer to remain independent of specific hashing implementations (argon2, bcrypt, etc.)
+///
+/// Methods are async because implementations (e.g. Argon2) are CPU-intensive
+/// and must run on a blocking thread pool to avoid starving Tokio workers.
+#[async_trait]
 pub trait PasswordHasherPort: Send + Sync + 'static {
     /// Hash a plain text password
-    fn hash_password(&self, password: &str) -> Result<String, DomainError>;
+    async fn hash_password(&self, password: &str) -> Result<String, DomainError>;
 
     /// Verify a plain text password against a hash
-    fn verify_password(&self, password: &str, hash: &str) -> Result<bool, DomainError>;
+    async fn verify_password(&self, password: &str, hash: &str) -> Result<bool, DomainError>;
 }
 
 /// Claims contained in a JWT token

src/application/ports/dedup_ports.rs

@@ -122,15 +122,7 @@ pub trait DedupPort: Send + Sync + 'static {
     /// Get metadata for a blob.
     async fn get_blob_metadata(&self, hash: &str) -> Option<BlobMetadataDto>;
 
-    /// Read blob content as raw bytes.
-    async fn read_blob(&self, hash: &str) -> Result<Vec<u8>, DomainError>;
-
-    /// Read blob content as `Bytes`.
-    async fn read_blob_bytes(&self, hash: &str) -> Result<Bytes, DomainError>;
-
     /// Stream blob content in chunks (64 KB default) — constant memory usage.
-    ///
-    /// Unlike `read_blob()`, this never loads the entire file into RAM.
     async fn read_blob_stream(
         &self,
         hash: &str,

src/application/ports/file_ports.rs

@@ -120,9 +120,6 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
     /// Lists files in a folder
     async fn list_files(&self, folder_id: Option<&str>) -> Result<Vec<FileDto>, DomainError>;
 
-    /// Gets file content as bytes (for small files)
-    async fn get_file_content(&self, id: &str) -> Result<Vec<u8>, DomainError>;
-
     /// Gets file content as a stream (for large files)
     async fn get_file_stream(
         &self,

src/application/ports/storage_ports.rs

@@ -32,9 +32,6 @@ pub trait FileReadPort: Send + Sync + 'static {
     /// Lists files in a folder.
     async fn list_files(&self, folder_id: Option<&str>) -> Result<Vec<File>, DomainError>;
 
-    /// Gets the full content as bytes (small/medium files only).
-    async fn get_file_content(&self, id: &str) -> Result<Vec<u8>, DomainError>;
-
     /// Gets content as a stream (ideal for large files).
     async fn get_file_stream(
         &self,
@@ -49,9 +46,6 @@ pub trait FileReadPort: Send + Sync + 'static {
         end: Option<u64>,
     ) -> Result<Box<dyn Stream<Item = Result<Bytes, std::io::Error>> + Send>, DomainError>;
 
-    /// Memory-map of a file for zero-copy access (10–100 MB).
-    async fn get_file_mmap(&self, id: &str) -> Result<Bytes, DomainError>;
-
     /// Gets the logical storage path of a file.
     async fn get_file_path(&self, id: &str) -> Result<StoragePath, DomainError>;