refactor(services): add file_lifecycle and blob_lifecycle

- complete src/application/ports/blob_lifecycle.rs with traits:
    * BlobCreationHook
    * BlobDeletionHook

 - add src/application/ports/file_lifecycle.rs with traits:
    * FileCreatedHook
    * FileDeletedHook
    * FileUpdatedHook

src/infrastructure/services/dedup_service.rs

@@ -44,7 +44,7 @@ use std::sync::Arc;
 use tokio::fs;
 use tokio::io::{AsyncReadExt, AsyncSeekExt};
 
-use crate::application::ports::blob_lifecycle::BlobDeletionHook;
+use crate::application::ports::blob_lifecycle::{BlobCreationHook, BlobDeletionHook};
 use crate::application::ports::blob_storage_ports::BlobStorageBackend;
 use crate::application::ports::dedup_ports::{
     BlobMetadataDto, DedupPort, DedupResultDto, DedupStatsDto,
@@ -84,6 +84,8 @@ pub struct DedupService {
     /// Isolated maintenance pool for long-running operations
     /// (verify_integrity, garbage_collect) that must never starve the primary.
     maintenance_pool: Arc<PgPool>,
+    /// Hooks notified when a genuinely new blob is stored (no dedup hit).
+    blob_creation_hooks: Vec<Arc<dyn BlobCreationHook>>,
     /// Hooks notified when a blob's ref_count reaches zero and it is deleted.
     blob_hooks: Vec<Arc<dyn BlobDeletionHook>>,
 }
@@ -103,10 +105,18 @@ impl DedupService {
             backend,
             pool,
             maintenance_pool,
+            blob_creation_hooks: vec![],
             blob_hooks: vec![],
         }
     }
 
+    /// Register a [`BlobCreationHook`] to be called whenever a genuinely new
+    /// blob is stored.  Hooks are called in registration order.
+    pub fn add_blob_creation_hook(mut self, hook: Arc<dyn BlobCreationHook>) -> Self {
+        self.blob_creation_hooks.push(hook);
+        self
+    }
+
     /// Register a [`BlobDeletionHook`] to be called whenever a blob's
     /// ref_count reaches zero.  Hooks are called in registration order.
     pub fn add_blob_hook(mut self, hook: Arc<dyn BlobDeletionHook>) -> Self {
@@ -114,6 +124,13 @@ impl DedupService {
         self
     }
 
+    /// Fire all registered creation hooks for a new blob.
+    async fn fire_blob_creation_hooks(&self, hash: &str, content_type: Option<&str>) {
+        for hook in &self.blob_creation_hooks {
+            hook.on_blob_created(hash, content_type).await;
+        }
+    }
+
     /// Fire all registered hooks for a deleted blob.
     async fn fire_blob_hooks(&self, hash: &str) {
         for hook in &self.blob_hooks {
@@ -135,6 +152,7 @@ impl DedupService {
             backend: Arc::new(LocalBlobBackend::new(Path::new("/tmp/oxicloud_stub_blobs"))),
             pool: stub_pool.clone(),
             maintenance_pool: stub_pool,
+            blob_creation_hooks: vec![],
             blob_hooks: vec![],
         }
     }
@@ -353,6 +371,9 @@ impl DedupService {
             chunk_hashes.len()
         );
 
+        self.fire_blob_creation_hooks(&file_hash, content_type.as_deref())
+            .await;
+
         Ok(DedupResultDto::NewBlob {
             hash: file_hash,
             size: file_size,

src/infrastructure/services/thumbnail_service.rs

@@ -995,6 +995,111 @@ impl crate::application::ports::blob_lifecycle::BlobDeletionHook for ThumbnailSe
     }
 }
 
+// ─── FileUpdatedHook ─────────────────────────────────────────────────────────
+
+/// Wires thumbnail invalidation + regeneration into the file-update lifecycle.
+///
+/// Registered on [`FileUploadService`] during DI. Fires whenever a file's blob
+/// is replaced (WebDAV PUT overwrite, WOPI PutFile, Nextcloud chunked upload).
+pub struct ThumbnailRefreshHook {
+    thumbnail: Arc<ThumbnailService>,
+    dedup: Arc<DedupService>,
+}
+
+impl ThumbnailRefreshHook {
+    pub fn new(thumbnail: Arc<ThumbnailService>, dedup: Arc<DedupService>) -> Self {
+        Self { thumbnail, dedup }
+    }
+}
+
+impl crate::application::ports::file_lifecycle::FileUpdatedHook for ThumbnailRefreshHook {
+    fn on_file_updated<'a>(
+        &'a self,
+        file_id: &'a str,
+        blob_hash: &'a str,
+        content_type: &'a str,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = ()> + Send + 'a>> {
+        Box::pin(async move {
+            if !ThumbnailService::is_supported_image(content_type) {
+                return;
+            }
+            if let Err(e) = self.thumbnail.delete_thumbnails(file_id).await {
+                tracing::warn!(
+                    "Failed to invalidate thumbnail cache for {}: {}",
+                    file_id,
+                    e
+                );
+            }
+            Self::spawn_thumbnail_generation(
+                self.thumbnail.clone(),
+                self.dedup.clone(),
+                file_id.to_string(),
+                blob_hash.to_string(),
+            );
+        })
+    }
+}
+
+impl crate::application::ports::file_lifecycle::FileCreatedHook for ThumbnailRefreshHook {
+    fn on_file_created<'a>(
+        &'a self,
+        file_id: &'a str,
+        blob_hash: &'a str,
+        content_type: &'a str,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = ()> + Send + 'a>> {
+        Box::pin(async move {
+            if !ThumbnailService::is_supported_image(content_type) {
+                return;
+            }
+            Self::spawn_thumbnail_generation(
+                self.thumbnail.clone(),
+                self.dedup.clone(),
+                file_id.to_string(),
+                blob_hash.to_string(),
+            );
+        })
+    }
+}
+
+impl ThumbnailRefreshHook {
+    fn spawn_thumbnail_generation(
+        ts: Arc<ThumbnailService>,
+        ds: Arc<DedupService>,
+        file_id: String,
+        hash: String,
+    ) {
+        tokio::spawn(async move {
+            match ds.read_blob_bytes(&hash).await {
+                Ok(bytes) => {
+                    ts.generate_all_sizes_background_from_bytes(file_id, hash, bytes, ds.clone());
+                }
+                Err(e) => {
+                    tracing::warn!(
+                        "Failed to read blob for thumbnail generation {}: {}",
+                        file_id,
+                        e
+                    );
+                }
+            }
+        });
+    }
+}
+
+// ─── FileDeletedHook ─────────────────────────────────────────────────────────
+
+impl crate::application::ports::file_lifecycle::FileDeletedHook for ThumbnailService {
+    fn on_file_deleted<'a>(
+        &'a self,
+        file_id: &'a str,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = ()> + Send + 'a>> {
+        Box::pin(async move {
+            if let Err(e) = self.delete_thumbnails(file_id).await {
+                tracing::warn!("Failed to delete thumbnails for file {}: {}", file_id, e);
+            }
+        })
+    }
+}
+
 // ─── Port implementation ─────────────────────────────────────────────────────
 
 /// Convert port ThumbnailSize to infra ThumbnailSize.