perf: round 10 — auth alloc purge, parent-herd batching, query-shape pack, NC 304s

Benchmark-gated (benches/ROUND10.md; every change carries a BEFORE/AFTER
harness with equivalence/safety gates — two designs were rejected or
rewritten by their own benches before adoption):

- Auth hot path: TokenClaims/CurrentUser display fields to Arc<str>, role
  to inline SmolStr end-to-end (Bearer, cookie, Basic-auth cache) — 4→1
  allocs per authenticated request, 3→0 per warm DAV request; JWT
  Encoding/Decoding/Validation built once.
- Cold shared-album herd: leader-inline parent batching in PgAclEngine
  (+ cascade try_get_with single-flight) — 100→2 parent queries per
  100-thumb cold herd, herd wall 1.9x, sequential + warm paths unchanged,
  all ROUND8/9 safety gates plus new herd-equivalence gates.
- Query-shape pack: share download double-fetch 2→1 (2.18x), contact-group
  COUNT(*) 14.9x, save_faces UNNEST 3.9x, playlist reorder UNNEST 63.7x
  (now atomic), search files∥folders join! 1.45x, move drive-lookup join!
  2.14x, trash partial (drive_id, trashed_at) indexes, CalDAV event-gate
  narrow read, favorites/recents binary-decode port, dead count_files
  removed.
- NC surface: preview + avatar honour If-None-Match (e2e: 5 KB and 197 KB
  → 0 bytes per revalidation), avatar WebP→PNG transcode memoised,
  PROPFIND/trashbin integer+date emits on stack formatters, folder-header
  enrichment join!, chunk-PUT retry stat folded into create_new open.
- common::fmt integer rendering rewritten on the std 2-digit LUT after the
  round's own bench caught the div-loop losing to to_string (16.1 ns vs
  22.5; speeds every prior-round call site).
- Micro-pack: WebDAV scope probe borrow-only, ShareService base_url
  snapshot, cookie_secure OnceLock, Arc'd AES-GCM cipher, stack request-id,
  tantivy analyzer clone dropped.
- SPA: search stale-guard + AbortController (10→1 completed round-trips,
  stale-clobber gone), getFolder in-flight dedup, gridColumns matchMedia
  hoist (10k→0 style reads).

Backend: cargo fmt + clippy -D warnings clean, 524 tests green.
Frontend: npm run check clean, 301 vitest green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DdM7V7M3QPW7HEHg3gLov

examples/bench_thumbnail_cascade_cache.rs

@@ -475,6 +475,87 @@ async fn main() {
         );
     }
 
+    // ── ROUND10: the CONCURRENT cold herd ────────────────────────────
+    // A browser grid fires its thumbnail requests near-simultaneously, so
+    // the real cold first view is K in-flight checks, not a sequential
+    // loop. BEFORE (round-9 shape): every request pays its own parent
+    // point read — replicated below as K concurrent `SELECT folder_id`
+    // probes + the shared folder decision. AFTER: the engine's parent
+    // batcher drains the herd into ~2 queries.
+    {
+        // BEFORE replica: K concurrent point reads (the R9 per-request work).
+        let t = Instant::now();
+        let probes = s.files.iter().map(|&f| {
+            let pool = pool.clone();
+            async move {
+                let parent: Option<Option<Uuid>> =
+                    sqlx::query_scalar("SELECT folder_id FROM storage.files WHERE id = $1")
+                        .bind(f)
+                        .fetch_optional(pool.as_ref())
+                        .await
+                        .expect("point parent read");
+                parent.flatten()
+            }
+        });
+        let before_parents = futures::future::join_all(probes).await;
+        let el = t.elapsed();
+        println!(
+            "| {:<28} | {:>10.2} | {:>12.2} |",
+            "R9 herd (point read/file)",
+            el.as_secs_f64() * 1e3,
+            el.as_secs_f64() * 1e6 / thumbs as f64
+        );
+
+        // AFTER: fresh engine, all K checks in flight at once.
+        let herd_engine = fresh_engine(&pool);
+        let t = Instant::now();
+        let checks = s
+            .files
+            .iter()
+            .map(|&f| allowed(&herd_engine, s.recipient, f));
+        let results = futures::future::join_all(checks).await;
+        let el = t.elapsed();
+        let parent_queries = herd_engine.parent_query_count();
+        println!(
+            "| {:<28} | {:>10.2} | {:>12.2} |",
+            "AFTER herd (batched)",
+            el.as_secs_f64() * 1e3,
+            el.as_secs_f64() * 1e6 / thumbs as f64
+        );
+        println!(
+            "|   parent queries for the {thumbs}-thumb herd: {parent_queries} (was {thumbs})            |"
+        );
+
+        // Gates: every check allowed; the herd collapsed (≤8 queries for a
+        // 100-wide herd would already be a pass; typical is 2-3); and the
+        // batcher's answers match the point reads exactly.
+        if results.iter().any(|ok| !ok) {
+            eprintln!("SAFETY GATE FAILED: batched herd denied an allowed thumbnail");
+            cleanup(&pool, &s).await;
+            std::process::exit(1);
+        }
+        if parent_queries as usize >= thumbs / 4 {
+            eprintln!(
+                "PERF GATE FAILED: parent batcher issued {parent_queries} queries for a {thumbs}-thumb herd"
+            );
+            cleanup(&pool, &s).await;
+            std::process::exit(1);
+        }
+        for (i, &f) in s.files.iter().enumerate() {
+            let via_engine: Option<Option<Uuid>> =
+                sqlx::query_scalar("SELECT folder_id FROM storage.files WHERE id = $1")
+                    .bind(f)
+                    .fetch_optional(pool.as_ref())
+                    .await
+                    .expect("verify parent");
+            assert_eq!(
+                via_engine.flatten(),
+                before_parents[i],
+                "parent resolution must be identical"
+            );
+        }
+    }
+
     cleanup(&pool, &s).await;
     println!("\n(The check is never skipped — authz still runs on every thumbnail; only");
     println!(" the folder-cascade DECISION is memoised. BEFORE re-queries per request;");