perf: round 20 — iCal/vCard parse allocs, owned-DTO moves, Result-collect pre-size, NC etag/favorites emit

Benchmark-gated (benches/ROUND20.md), same rule as rounds 2-19: every change
ships with a BEFORE/AFTER counting-allocator micro-benchmark and a byte-value
equivalence gate; a non-winning AFTER is rolled back (never applied). The
rollback rule is encoded in the harness (GATE FAIL exit). All 8 sections pass.

Reproduce: cargo run --release --features bench --example bench_round20_micro

- A1 CalendarEvent iCal parse: replace the throwaway per-property
  HashMap<String,Vec<String>> (DTSTART/DTEND/RECURRENCE-ID) with a direct
  VALUE=DATE scan; prop_with_params kept #[cfg(test)] (6->2 allocs/event, 4.2x)
- A2 UserDto::from: add User::into_parts and MOVE image (<=512 KiB data URI)
  + ui_preferences JSON instead of cloning on every /api/auth/me (27->14 allocs)
- A3 parse_vcard: drop the per-line to_ascii_uppercase copy + the lines Vec;
  promote ascii_ci_contains to common::text and share it (8->1 allocs/contact)
- A4 Calendar/AddressBook DTO: into_parts move incl. custom_properties map (18->10)
- I1 file-listing repos: collect::<Result<Vec>>() size-hints to 0 and grows from
  capacity 0; pre-size with Vec::with_capacity (8->1 container reallocs, 4 sites)
- I4 plaintext_stream: lazy emit iterator instead of eager Vec collect (43x wall)
- C1 NC write_etag_element: borrowed pre-escaped quote events, no owned quoted
  String/escape re-alloc; byte-identical output (3->0 allocs/PROPFIND row)
- C3 NC favorites REPORT: map.remove() move instead of get().clone() (~7 allocs/fav)

Deferred (documented in ROUND20.md): NC oc:id/trashbin buffer reuse, I1 sibling
CardDAV/CalDAV listing paths, Contact JSONB Json<Vec<_>> decode, dedup
settle_batch &str bind, and a fast DoS-resistant hasher for hot trusted-key maps
(needs a dependency decision).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JsJjcVX9RoN96DMa35Wqzd

src/domain/entities/user.rs

@@ -135,7 +135,88 @@ pub struct User {
     ui_preferences: serde_json::Value,
 }
 
+/// Owned decomposition of a [`User`] (mirrors `FileParts` / `FolderParts` /
+/// `ContactParts`). Lets a consumer MOVE the heap fields out instead of cloning
+/// them through the borrowing accessors — notably `image` (a data URI up to
+/// 512 KiB) and `ui_preferences` (a JSON tree). See `UserDto::from`
+/// (benches/ROUND20.md §A2).
+pub struct UserParts {
+    pub id: Uuid,
+    pub username: Option<String>,
+    pub email: String,
+    pub password_hash: Option<String>,
+    pub role: UserRole,
+    pub storage_quota_bytes: i64,
+    pub storage_used_bytes: i64,
+    pub created_at: DateTime<Utc>,
+    pub updated_at: DateTime<Utc>,
+    pub last_login_at: Option<DateTime<Utc>>,
+    pub active: bool,
+    pub oidc_provider: Option<String>,
+    pub oidc_subject: Option<String>,
+    pub image: Option<String>,
+    pub is_external: bool,
+    pub given_name: Option<String>,
+    pub family_name: Option<String>,
+    pub email_verified_at: Option<DateTime<Utc>>,
+    pub preferred_locale: Option<String>,
+    pub notify_on_share: bool,
+    pub ui_preferences: serde_json::Value,
+}
+
 impl User {
+    /// Decompose into [`UserParts`], moving every owned field out. The
+    /// exhaustive destructure is compiler-checked, so a future field can't be
+    /// silently dropped.
+    pub fn into_parts(self) -> UserParts {
+        let User {
+            id,
+            username,
+            email,
+            password_hash,
+            role,
+            storage_quota_bytes,
+            storage_used_bytes,
+            created_at,
+            updated_at,
+            last_login_at,
+            active,
+            oidc_provider,
+            oidc_subject,
+            image,
+            is_external,
+            given_name,
+            family_name,
+            email_verified_at,
+            preferred_locale,
+            notify_on_share,
+            ui_preferences,
+        } = self;
+        UserParts {
+            id,
+            username,
+            email,
+            password_hash,
+            role,
+            storage_quota_bytes,
+            storage_used_bytes,
+            created_at,
+            updated_at,
+            last_login_at,
+            active,
+            oidc_provider,
+            oidc_subject,
+            image,
+            is_external,
+            given_name,
+            family_name,
+            email_verified_at,
+            preferred_locale,
+            notify_on_share,
+            ui_preferences,
+        }
+    }
+
     /// Create a new user.
     ///
     /// One unified constructor for every kind of user (internal, OIDC-linked,