perf: round 10 — auth alloc purge, parent-herd batching, query-shape pack, NC 304s

Benchmark-gated (benches/ROUND10.md; every change carries a BEFORE/AFTER
harness with equivalence/safety gates — two designs were rejected or
rewritten by their own benches before adoption):

- Auth hot path: TokenClaims/CurrentUser display fields to Arc<str>, role
  to inline SmolStr end-to-end (Bearer, cookie, Basic-auth cache) — 4→1
  allocs per authenticated request, 3→0 per warm DAV request; JWT
  Encoding/Decoding/Validation built once.
- Cold shared-album herd: leader-inline parent batching in PgAclEngine
  (+ cascade try_get_with single-flight) — 100→2 parent queries per
  100-thumb cold herd, herd wall 1.9x, sequential + warm paths unchanged,
  all ROUND8/9 safety gates plus new herd-equivalence gates.
- Query-shape pack: share download double-fetch 2→1 (2.18x), contact-group
  COUNT(*) 14.9x, save_faces UNNEST 3.9x, playlist reorder UNNEST 63.7x
  (now atomic), search files∥folders join! 1.45x, move drive-lookup join!
  2.14x, trash partial (drive_id, trashed_at) indexes, CalDAV event-gate
  narrow read, favorites/recents binary-decode port, dead count_files
  removed.
- NC surface: preview + avatar honour If-None-Match (e2e: 5 KB and 197 KB
  → 0 bytes per revalidation), avatar WebP→PNG transcode memoised,
  PROPFIND/trashbin integer+date emits on stack formatters, folder-header
  enrichment join!, chunk-PUT retry stat folded into create_new open.
- common::fmt integer rendering rewritten on the std 2-digit LUT after the
  round's own bench caught the div-loop losing to to_string (16.1 ns vs
  22.5; speeds every prior-round call site).
- Micro-pack: WebDAV scope probe borrow-only, ShareService base_url
  snapshot, cookie_secure OnceLock, Arc'd AES-GCM cipher, stack request-id,
  tantivy analyzer clone dropped.
- SPA: search stale-guard + AbortController (10→1 completed round-trips,
  stale-clobber gone), getFolder in-flight dedup, gridColumns matchMedia
  hoist (10k→0 style reads).

Backend: cargo fmt + clippy -D warnings clean, 524 tests green.
Frontend: npm run check clean, 301 vitest green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DdM7V7M3QPW7HEHg3gLov

frontend/src/lib/utils/grid.test.ts

@@ -1,35 +1,60 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { gridColumns } from './grid';
+import { describe, it, expect, vi } from 'vitest';
 
-function mockMatchMedia(matches: boolean) {
+/**
+ * `gridColumns` reads the phone breakpoint from ONE module-level
+ * MediaQueryList (fed by its `change` listener) instead of constructing a
+ * fresh `matchMedia` per call — so tests set the media state BEFORE
+ * importing the module (a fresh import per state via `vi.resetModules`),
+ * and flips are delivered through the captured `change` listener, exactly
+ * as the browser does.
+ */
+type MqlListener = (e: { matches: boolean }) => void;
+
+async function importWithMedia(matches: boolean) {
+	const listeners: MqlListener[] = [];
 	vi.stubGlobal(
 		'matchMedia',
 		vi.fn().mockReturnValue({
 			matches,
 			media: '',
-			addEventListener: vi.fn(),
+			addEventListener: (_t: string, fn: MqlListener) => listeners.push(fn),
 			removeEventListener: vi.fn()
 		})
 	);
+	vi.resetModules();
+	const mod = await import('./grid');
+	return {
+		gridColumns: mod.gridColumns,
+		fire: (m: boolean) => listeners.forEach((l) => l({ matches: m }))
+	};
 }
 
 describe('gridColumns', () => {
-	beforeEach(() => mockMatchMedia(false));
-
-	it('returns 1 for non-positive width', () => {
+	it('returns 1 for non-positive width', async () => {
+		const { gridColumns } = await importWithMedia(false);
 		expect(gridColumns(0)).toBe(1);
 		expect(gridColumns(-100)).toBe(1);
 	});
 
-	it('computes columns at desktop sizing (cardMin 200, gap 20)', () => {
+	it('computes columns at desktop sizing (cardMin 200, gap 20)', async () => {
+		const { gridColumns } = await importWithMedia(false);
 		expect(gridColumns(220)).toBe(1); // floor(240/220)
 		expect(gridColumns(440)).toBe(2); // floor(460/220)
 		expect(gridColumns(900)).toBe(4); // floor(920/220)
 	});
 
-	it('uses mobile sizing when the phone media query matches', () => {
-		mockMatchMedia(true);
+	it('uses mobile sizing when the phone media query matches', async () => {
+		const { gridColumns } = await importWithMedia(true);
 		expect(gridColumns(300)).toBe(2); // floor(308/148)
 		expect(gridColumns(600)).toBe(4); // floor(608/148)
 	});
+
+	it('breakpoint crossings propagate through the change listener', async () => {
+		const { gridColumns, fire } = await importWithMedia(false);
+		expect(gridColumns(600)).toBe(2); // desktop sizing
+		fire(true); // viewport crossed under 640px
+		expect(gridColumns(600)).toBe(4); // mobile sizing
+		fire(false);
+		expect(gridColumns(600)).toBe(2);
+	});
 });