perf: OnceLock for env var, Arc<CurrentUser> in auth, pre-compute query lowercase

- rate_limit: cache OXICLOUD_TRUST_PROXY_HEADERS in OnceLock<bool> to avoid
  syscall on every request (~500ns → ~1ns)
- auth middleware: insert Arc<CurrentUser> instead of bare CurrentUser;
  all 5 extractors now clone Arc (~1ns) instead of 4 Strings (~60-100ns)
- search_service: pre-compute query.to_lowercase() once before loops,
  eliminating N redundant heap allocations per search

src/interfaces/nextcloud/basic_auth_middleware.rs

@@ -89,12 +89,12 @@ pub async fn basic_auth_middleware(
             if let Some(auth_svc) = state.auth_service.as_ref() {
                 auth_svc.login_lockout.record_success(&username);
             }
-            request.extensions_mut().insert(CurrentUser {
+            request.extensions_mut().insert(Arc::new(CurrentUser {
                 id: user_id,
                 username: uname,
                 email,
                 role,
-            });
+            }));
             Ok(next.run(request).await)
         }
         Err(_) => {