perf: round 10 — auth alloc purge, parent-herd batching, query-shape pack, NC 304s

Benchmark-gated (benches/ROUND10.md; every change carries a BEFORE/AFTER
harness with equivalence/safety gates — two designs were rejected or
rewritten by their own benches before adoption):

- Auth hot path: TokenClaims/CurrentUser display fields to Arc<str>, role
  to inline SmolStr end-to-end (Bearer, cookie, Basic-auth cache) — 4→1
  allocs per authenticated request, 3→0 per warm DAV request; JWT
  Encoding/Decoding/Validation built once.
- Cold shared-album herd: leader-inline parent batching in PgAclEngine
  (+ cascade try_get_with single-flight) — 100→2 parent queries per
  100-thumb cold herd, herd wall 1.9x, sequential + warm paths unchanged,
  all ROUND8/9 safety gates plus new herd-equivalence gates.
- Query-shape pack: share download double-fetch 2→1 (2.18x), contact-group
  COUNT(*) 14.9x, save_faces UNNEST 3.9x, playlist reorder UNNEST 63.7x
  (now atomic), search files∥folders join! 1.45x, move drive-lookup join!
  2.14x, trash partial (drive_id, trashed_at) indexes, CalDAV event-gate
  narrow read, favorites/recents binary-decode port, dead count_files
  removed.
- NC surface: preview + avatar honour If-None-Match (e2e: 5 KB and 197 KB
  → 0 bytes per revalidation), avatar WebP→PNG transcode memoised,
  PROPFIND/trashbin integer+date emits on stack formatters, folder-header
  enrichment join!, chunk-PUT retry stat folded into create_new open.
- common::fmt integer rendering rewritten on the std 2-digit LUT after the
  round's own bench caught the div-loop losing to to_string (16.1 ns vs
  22.5; speeds every prior-round call site).
- Micro-pack: WebDAV scope probe borrow-only, ShareService base_url
  snapshot, cookie_secure OnceLock, Arc'd AES-GCM cipher, stack request-id,
  tantivy analyzer clone dropped.
- SPA: search stale-guard + AbortController (10→1 completed round-trips,
  stale-clobber gone), getFolder in-flight dedup, gridColumns matchMedia
  hoist (10k→0 style reads).

Backend: cargo fmt + clippy -D warnings clean, 524 tests green.
Frontend: npm run check clean, 301 vitest green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DdM7V7M3QPW7HEHg3gLov

src/interfaces/upload_ingest.rs

@@ -291,6 +291,10 @@ pub fn stream_from_files(
 pub struct StreamedToPath {
     /// Total bytes written.
     pub bytes_written: u64,
+    /// `true` when the destination did not exist before this call — the
+    /// open itself detects it (`create_new` + AlreadyExists fallback), so
+    /// retry-detection callers don't need a separate `stat` per chunk.
+    pub created_fresh: bool,
     /// Lowercase hex digest, populated only when `checksum_alg=Some(_)`
     /// was passed. The algorithm is identified by [`StreamedToPath::alg`].
     pub checksum_hex: Option<String>,
@@ -329,9 +333,32 @@ pub async fn stream_body_to_path(
     // per frame (benches/UPLOAD-SPOOL.md). Same capacity as the dedup
     // handler's spool loop. On the error paths below the partial file is
     // removed, so silently dropping unflushed buffer contents is fine.
-    let file = tokio::fs::File::create(path)
+    //
+    // `create_new` first: the common fresh-chunk case stays one open AND
+    // doubles as the retry probe (AlreadyExists → truncate-open), so callers
+    // that need overwrite detection no longer pay a separate stat per chunk.
+    let (file, created_fresh) = match tokio::fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(path)
         .await
-        .map_err(|e| AppError::internal_error(format!("Failed to open chunk file: {e}")))?;
+    {
+        Ok(f) => (f, true),
+        Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {
+            let f = tokio::fs::OpenOptions::new()
+                .write(true)
+                .truncate(true)
+                .open(path)
+                .await
+                .map_err(|e| AppError::internal_error(format!("Failed to open chunk file: {e}")))?;
+            (f, false)
+        }
+        Err(e) => {
+            return Err(AppError::internal_error(format!(
+                "Failed to open chunk file: {e}"
+            )));
+        }
+    };
     let mut file = tokio::io::BufWriter::with_capacity(512 * 1024, file);
 
     let mut total_bytes: usize = 0;
@@ -377,6 +404,7 @@ pub async fn stream_body_to_path(
 
     Ok(StreamedToPath {
         bytes_written: total_bytes as u64,
+        created_fresh,
         checksum_hex: hasher.map(IncrementalHasher::finalize_hex),
         alg: checksum_alg,
     })