perf: round 14 — faces narrow projection, auth per-request allocs, CalDAV emit buffers, frontend set churn

Benchmark-gated (benches/ROUND14.md); every change ships a BEFORE/AFTER
benchmark with an equivalence gate and is rolled back on regression (the
rule is encoded as a GATE FAIL exit / threshold expect).

Backend
- Q1 faces_for_file → narrow face_boxes_for_file(id, person_id, bbox) with the
  caller filter pushed into SQL: drops the 2 KiB embedding BYTEA + 6 unused
  columns per face. 15-face lightbox open 0.312→0.219 ms, 32 KB→840 B/req.
- A1 cookie auth uses the borrow-only extract_cookie_str (already backs CSRF)
  instead of extract_cookie_value's owned String: -1 alloc/cookie request.
- A2 compute_relevance ASCII case-fold fast path vs name.to_lowercase() per
  result row (Unicode fallback preserved): 1.40x, 12→3 allocs/page.
- A3 sub pre-parsed to Uuid at decode time (TokenClaims.sub_id) vs re-parsing
  the 36-char claim on every request incl. cache hits: 22.7→0.7 ns.
- A4 auth + NextCloud middlewares borrow request.headers() instead of taking
  axum's HeaderMap extractor (a full map clone): 2→0 allocs/authed request.
- A5 CalDAV getlastmodified via the stack rfc2822_utc (byte-identical to
  chrono) vs a per-event to_rfc2822() heap String: 5→0 allocs.
- A6 CalDAV per-event href + quoted etag written into reused page buffers vs a
  fresh format! pair per event: 3.48x, 240→6 allocs/40-event page.

Frontend
- F1 t() shares one frozen EMPTY_PARAMS for the no-interpolation call forms vs
  a throwaway {} per call: -1 alloc/call.
- F2 favorites favoriteIds is a persistent SvelteSet with per-page add (clear
  on reset) vs a brand-new set over the whole accumulated list each page:
  22.3x over a 40-page drain (O(N^2)→O(N)).

Verified: cargo check --all-targets, cargo clippy -D warnings, both bench
packs (GATE PASS), frontend npm run check + vitest (4/4). ROUND14.md also
records the investigated-but-deferred backlog (music N+1, contact vcard
over-fetch, CachedBlobBackend syscalls, ResourceList.sections builder, etc.).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PymgCdK78NzUF3oRAQCJfN

src/infrastructure/repositories/pg/face_pg_repository.rs

@@ -13,7 +13,7 @@ use uuid::Uuid;
 
 use crate::application::ports::face_ports::FaceRepository;
 use crate::common::errors::DomainError;
-use crate::domain::entities::face::{BoundingBox, Face, Person};
+use crate::domain::entities::face::{BoundingBox, Face, FaceBox, Person};
 
 /// Row shape for `faces.faces` selects (avoids `clippy::type_complexity`).
 type FaceRow = (
@@ -182,14 +182,31 @@ impl FaceRepository for FacePgRepository {
         Ok(())
     }
 
-    async fn faces_for_file(&self, file_id: Uuid) -> Result<Vec<Face>, DomainError> {
-        let sql = format!("SELECT {FACE_COLS} FROM faces.faces WHERE file_id = $1");
-        let rows: Vec<FaceRow> = sqlx::query_as(&sql)
-            .bind(file_id)
-            .fetch_all(self.pool.as_ref())
-            .await
-            .map_err(|e| db_err("faces_for_file", e))?;
-        Ok(rows.into_iter().map(row_to_face).collect())
+    async fn face_boxes_for_file(
+        &self,
+        file_id: Uuid,
+        user_id: Uuid,
+    ) -> Result<Vec<FaceBox>, DomainError> {
+        // Narrow projection: the lightbox needs only (id, person_id, bbox), so
+        // the 2 KiB embedding BYTEA + 6 unused columns stay in the DB and the
+        // caller filter runs in SQL (idx_faces_file drives it) rather than in
+        // Rust after a full-row fetch. See benches/ROUND14.md §Q1.
+        let rows: Vec<(Uuid, Option<Uuid>, Vec<f32>)> = sqlx::query_as(
+            "SELECT id, person_id, bbox FROM faces.faces WHERE file_id = $1 AND user_id = $2",
+        )
+        .bind(file_id)
+        .bind(user_id)
+        .fetch_all(self.pool.as_ref())
+        .await
+        .map_err(|e| db_err("face_boxes_for_file", e))?;
+        Ok(rows
+            .into_iter()
+            .map(|(id, person_id, bbox)| FaceBox {
+                id,
+                person_id,
+                bbox: BoundingBox::from_slice(&bbox),
+            })
+            .collect())
     }
 
     async fn delete_faces_for_file(&self, file_id: Uuid) -> Result<(), DomainError> {

src/infrastructure/services/jwt_service.rs

@@ -49,7 +49,14 @@ struct JwtClaims {
 
 impl From<JwtClaims> for TokenClaims {
     fn from(claims: JwtClaims) -> Self {
+        // Pre-parse the subject once at decode time (amortized over the
+        // validation-cache TTL) so the auth middleware reads a `Copy` instead
+        // of re-parsing the 36-char string per request. A verified token we
+        // signed always carries a UUID `sub`; nil is a safe sentinel the
+        // middleware rejects. See benches/ROUND14.md §A3.
+        let sub_id = uuid::Uuid::parse_str(&claims.sub).unwrap_or_else(|_| uuid::Uuid::nil());
         TokenClaims {
+            sub_id,
             sub: claims.sub,
             exp: claims.exp,
             iat: claims.iat,