perf: round 19 — auth/WOPI/vCard/PROPFIND per-request & per-row alloc cuts

Benchmark-gated (examples/bench_round19_micro.rs, benches/ROUND19.md): every
section ships a BEFORE/AFTER counting-allocator arm with a byte/-value
equivalence gate and a GATE-FAIL-rollback exit. All eight pass. No Postgres.

- M1 verify_basic_auth cache key: blake3::hash(format!("{u}:{p}")) → incremental
  Hasher (byte-identical key, 2→0 allocs on every Basic-auth DAV request)
- M2 WopiTokenService: prebuild Validation/DecodingKey/EncodingKey in new()
  instead of per-call (mirrors JwtTokenService; 16→12 allocs/validate)
- V1/V2 vCard emit (contact_to_vcard/generate_vcard): FN fallback drops the
  throwaway to_string, NOTE skips the escape copy for newline-free notes, REV
  uses new common::fmt::compact_ical_utc stack renderer (11.5× vs chrono
  strftime, 3→0 allocs); per-contact 9→4 allocs
- M4 trash_service::row_to_item_dto: move name/path/blob_hash out of the owned
  row instead of cloning (3 clones/file row gone)
- M5 search cache key: Uuid::hyphenated().encode_lower stack buffer instead of
  to_string (identical u64 key, 1→0 allocs/request)
- M6 streaming PROPFIND: reuse one href buffer across the page instead of a
  format! per child (native + NC handlers; 192→3 allocs on a 64-child page)
- M7 nextcloud extract_url_user: return Cow instead of forcing into_owned
  (zero-alloc on the common ASCII-username path)

common::fmt::compact_ical_utc added with chrono-parity unit tests (CASES +
60-year sweep). cargo fmt + clippy --all-targets clean; 526 lib unit tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ront9bk7YMoffVQkGG47gh

Cargo.toml

@@ -354,6 +354,20 @@ name = "bench_micro_allocs"
 path = "examples/bench_micro_allocs.rs"
 required-features = ["bench"]
 
+# Round-19 battery ────────────────────────────────────────────────────────────
+
+# Round-19 CPU/alloc micro-pack — Basic-auth cache-key incremental blake3 (drop
+# the per-request `format!("{u}:{p}")` String), WOPI validate/generate prebuilt
+# Validation/DecodingKey/EncodingKey (mirrors JwtTokenService), CardDAV vCard
+# per-contact emit (FN fallback `to_string` drop, NOTE no-newline borrow, REV via
+# new `common::fmt::compact_ical_utc` stack renderer), trash row→DTO move-not-clone,
+# search cache-key Uuid stack hyphenated-encode, streaming PROPFIND per-child href
+# reused buffer, NC `extract_url_user` Cow (drop `into_owned`). No Postgres.
+[[example]]
+name = "bench_round19_micro"
+path = "examples/bench_round19_micro.rs"
+required-features = ["bench"]
+
 # Round-18 battery ────────────────────────────────────────────────────────────
 
 # Round-18 calendar-event edit CPU/alloc micro-pack — `update_ical_property` /