perf: round 10 — auth alloc purge, parent-herd batching, query-shape pack, NC 304s

Benchmark-gated (benches/ROUND10.md; every change carries a BEFORE/AFTER
harness with equivalence/safety gates — two designs were rejected or
rewritten by their own benches before adoption):

- Auth hot path: TokenClaims/CurrentUser display fields to Arc<str>, role
  to inline SmolStr end-to-end (Bearer, cookie, Basic-auth cache) — 4→1
  allocs per authenticated request, 3→0 per warm DAV request; JWT
  Encoding/Decoding/Validation built once.
- Cold shared-album herd: leader-inline parent batching in PgAclEngine
  (+ cascade try_get_with single-flight) — 100→2 parent queries per
  100-thumb cold herd, herd wall 1.9x, sequential + warm paths unchanged,
  all ROUND8/9 safety gates plus new herd-equivalence gates.
- Query-shape pack: share download double-fetch 2→1 (2.18x), contact-group
  COUNT(*) 14.9x, save_faces UNNEST 3.9x, playlist reorder UNNEST 63.7x
  (now atomic), search files∥folders join! 1.45x, move drive-lookup join!
  2.14x, trash partial (drive_id, trashed_at) indexes, CalDAV event-gate
  narrow read, favorites/recents binary-decode port, dead count_files
  removed.
- NC surface: preview + avatar honour If-None-Match (e2e: 5 KB and 197 KB
  → 0 bytes per revalidation), avatar WebP→PNG transcode memoised,
  PROPFIND/trashbin integer+date emits on stack formatters, folder-header
  enrichment join!, chunk-PUT retry stat folded into create_new open.
- common::fmt integer rendering rewritten on the std 2-digit LUT after the
  round's own bench caught the div-loop losing to to_string (16.1 ns vs
  22.5; speeds every prior-round call site).
- Micro-pack: WebDAV scope probe borrow-only, ShareService base_url
  snapshot, cookie_secure OnceLock, Arc'd AES-GCM cipher, stack request-id,
  tantivy analyzer clone dropped.
- SPA: search stale-guard + AbortController (10→1 completed round-trips,
  stale-clobber gone), getFolder in-flight dedup, gridColumns matchMedia
  hoist (10k→0 style reads).

Backend: cargo fmt + clippy -D warnings clean, 524 tests green.
Frontend: npm run check clean, 301 vitest green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DdM7V7M3QPW7HEHg3gLov

frontend/src/lib/components/AppShell.svelte

@@ -130,6 +130,11 @@
 	let suggestOpen = $state(false);
 	let suggestBusy = $state(false);
 	let suggestTimer: ReturnType<typeof setTimeout> | null = null;
+	// Stale-response guard (same family as the search page): the debounce
+	// spaces requests out but doesn't stop a SLOW earlier response from
+	// resolving after a newer one and overwriting its suggestions.
+	let suggestSeq = 0;
+	let suggestInflight: AbortController | null = null;
 
 	function goToResults() {
 		const q = searchQuery.trim();
@@ -149,24 +154,33 @@
 		if (suggestTimer) clearTimeout(suggestTimer);
 		const q = searchQuery.trim();
 		if (q.length < 2) {
+			suggestSeq++;
+			suggestInflight?.abort();
+			suggestInflight = null;
 			suggestions = [];
 			suggestOpen = false;
 			return;
 		}
 		suggestTimer = setTimeout(async () => {
+			const seq = ++suggestSeq;
+			suggestInflight?.abort();
+			const ctl = new AbortController();
+			suggestInflight = ctl;
 			suggestBusy = true;
 			try {
-				const r = await searchFiles(q, { recursive: true, limit: 6 });
+				const r = await searchFiles(q, { recursive: true, limit: 6, signal: ctl.signal });
+				if (seq !== suggestSeq) return; // superseded while awaiting
 				suggestions = [
 					...r.folders.slice(0, 3).map((item) => ({ kind: 'folder' as const, item })),
 					...r.files.slice(0, 6).map((item) => ({ kind: 'file' as const, item }))
 				];
 				suggestOpen = suggestions.length > 0;
 			} catch {
+				if (seq !== suggestSeq || ctl.signal.aborted) return;
 				suggestions = [];
 				suggestOpen = false;
 			} finally {
-				suggestBusy = false;
+				if (seq === suggestSeq) suggestBusy = false;
 			}
 		}, 250);
 	}