perf: round 10 — auth alloc purge, parent-herd batching, query-shape pack, NC 304s

Benchmark-gated (benches/ROUND10.md; every change carries a BEFORE/AFTER
harness with equivalence/safety gates — two designs were rejected or
rewritten by their own benches before adoption):

- Auth hot path: TokenClaims/CurrentUser display fields to Arc<str>, role
  to inline SmolStr end-to-end (Bearer, cookie, Basic-auth cache) — 4→1
  allocs per authenticated request, 3→0 per warm DAV request; JWT
  Encoding/Decoding/Validation built once.
- Cold shared-album herd: leader-inline parent batching in PgAclEngine
  (+ cascade try_get_with single-flight) — 100→2 parent queries per
  100-thumb cold herd, herd wall 1.9x, sequential + warm paths unchanged,
  all ROUND8/9 safety gates plus new herd-equivalence gates.
- Query-shape pack: share download double-fetch 2→1 (2.18x), contact-group
  COUNT(*) 14.9x, save_faces UNNEST 3.9x, playlist reorder UNNEST 63.7x
  (now atomic), search files∥folders join! 1.45x, move drive-lookup join!
  2.14x, trash partial (drive_id, trashed_at) indexes, CalDAV event-gate
  narrow read, favorites/recents binary-decode port, dead count_files
  removed.
- NC surface: preview + avatar honour If-None-Match (e2e: 5 KB and 197 KB
  → 0 bytes per revalidation), avatar WebP→PNG transcode memoised,
  PROPFIND/trashbin integer+date emits on stack formatters, folder-header
  enrichment join!, chunk-PUT retry stat folded into create_new open.
- common::fmt integer rendering rewritten on the std 2-digit LUT after the
  round's own bench caught the div-loop losing to to_string (16.1 ns vs
  22.5; speeds every prior-round call site).
- Micro-pack: WebDAV scope probe borrow-only, ShareService base_url
  snapshot, cookie_secure OnceLock, Arc'd AES-GCM cipher, stack request-id,
  tantivy analyzer clone dropped.
- SPA: search stale-guard + AbortController (10→1 completed round-trips,
  stale-clobber gone), getFolder in-flight dedup, gridColumns matchMedia
  hoist (10k→0 style reads).

Backend: cargo fmt + clippy -D warnings clean, 524 tests green.
Frontend: npm run check clean, 301 vitest green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DdM7V7M3QPW7HEHg3gLov

frontend/src/lib/utils/grid.bench.test.ts

@@ -0,0 +1,84 @@
+import { describe, expect, it, vi } from 'vitest';
+
+/**
+ * Benchmark gate for the module-level MediaQueryList in
+ * {@link gridColumns} (`lib/utils/grid.ts`).
+ *
+ * Audit finding: `gridColumns` constructed a fresh
+ * `window.matchMedia('(max-width: 640px)')` on EVERY invocation — a style
+ * read per call — and it is called from the grid windowing derives on every
+ * width recompute (`ResourceList.gridCols`, files grid rows). This is the
+ * same anti-pattern the photos timeline already fixed by hoisting to one
+ * listener-fed flag.
+ *
+ * Gates:
+ *  1. Output identity — for a sweep of widths, the hoisted implementation
+ *     returns exactly what the per-call implementation returns (both mobile
+ *     and desktop breakpoint states).
+ *  2. Perf — 10 000 calls construct 0 additional MediaQueryList objects
+ *     (BEFORE: 10 000) and run ≥5x faster.
+ */
+
+interface FakeMql {
+	matches: boolean;
+	addEventListener: (t: string, fn: (e: { matches: boolean }) => void) => void;
+}
+
+function installMatchMedia(matches: boolean, counter: { constructed: number }): void {
+	vi.stubGlobal(
+		'matchMedia',
+		vi.fn((): FakeMql => {
+			counter.constructed++;
+			return { matches, addEventListener: () => {} };
+		})
+	);
+	// jsdom exposes window === globalThis in vitest; stub both lookup paths.
+	(window as unknown as { matchMedia: unknown }).matchMedia = globalThis.matchMedia;
+}
+
+/** BEFORE — verbatim old shape: fresh matchMedia per call. */
+function gridColumnsBefore(width: number): number {
+	if (width <= 0) return 1;
+	const mobile = typeof window !== 'undefined' && window.matchMedia('(max-width: 640px)').matches;
+	const cardMin = mobile ? 140 : 200;
+	const gap = mobile ? 8 : 20;
+	return Math.max(1, Math.floor((width + gap) / (cardMin + gap)));
+}
+
+describe('gridColumns matchMedia hoist (benchmark gate)', () => {
+	it('output identity across widths + constructions collapse to ≤1', async () => {
+		const counter = { constructed: 0 };
+		installMatchMedia(false, counter);
+		// Import AFTER stubbing so the module-level MQL uses the stub.
+		vi.resetModules();
+		const { gridColumns } = await import('./grid');
+		const afterModuleConstructions = counter.constructed; // the one hoisted MQL
+		expect(afterModuleConstructions).toBeLessThanOrEqual(1);
+
+		const widths = [-10, 0, 120, 320, 640, 641, 800, 1024, 1440, 1920, 2560];
+		for (const w of widths) {
+			expect(gridColumns(w)).toBe(gridColumnsBefore(w));
+		}
+
+		const N = 10_000;
+		counter.constructed = 0;
+		const t0 = performance.now();
+		let accBefore = 0;
+		for (let i = 0; i < N; i++) accBefore += gridColumnsBefore(300 + (i % 1200));
+		const beforeMs = performance.now() - t0;
+		const beforeConstructed = counter.constructed;
+
+		counter.constructed = 0;
+		const t1 = performance.now();
+		let accAfter = 0;
+		for (let i = 0; i < N; i++) accAfter += gridColumns(300 + (i % 1200));
+		const afterMs = performance.now() - t1;
+
+		expect(accAfter).toBe(accBefore); // identity over the whole sweep
+		expect(beforeConstructed).toBe(N);
+		expect(counter.constructed).toBe(0); // zero style reads per call now
+		console.log(
+			`[bench] gridColumns x${N}: BEFORE ${beforeMs.toFixed(1)} ms (${beforeConstructed} MQL constructions) → AFTER ${afterMs.toFixed(1)} ms (0 constructions)`
+		);
+	});
+});