Stream uploads directly into the CDC chunk store (no spool, single write)

Every upload surface previously wrote each byte to disk twice: the HTTP
body was spooled to a temp file (or assembled from chunk parts), then
mmap-re-read for FastCDC analysis, and finally the new chunks were
written to the blob backend. CDC could not start until the last byte
arrived, so large uploads paid receive + reread + rewrite latency.

The dedup engine now chunks, hashes and settles the stream WHILE it
arrives (fastcdc AsyncStreamCDC + incremental BLAKE3):

- Each batch of distinct chunks is pinned-or-classified by ONE
  `UPDATE … RETURNING` (no check-then-bump TOCTOU; pinned chunks can't
  be reclaimed mid-upload), and only chunks the store doesn't have are
  written — a full dedup hit performs zero content writes.
- Durability before visibility is preserved: one batched fsync sweep,
  then one batched INSERT, then the manifest. Identical concurrent
  uploads are resolved at the manifest INSERT via ON CONFLICT (the
  loser releases its references and becomes a dedup hit).
- A drop guard rolls back pins and surfaces written-but-unregistered
  chunks to GC if the request future is cancelled mid-stream.
- MIME sniffing now peeks the first bytes in-flight; client-requested
  MD5/SHA-256 checksums are computed by a stream tee — the post-upload
  re-read of the assembled file is gone.

All surfaces converge on the new interfaces::upload_ingest helper:
REST multipart, WebDAV PUT, NextCloud PUT, WOPI PutFile, the dedup
endpoint, and both chunked-upload completions (which now stream their
ordered parts straight into the store instead of writing an assembled
file — chunk parts persist until finalize, so completion is genuinely
retryable). The legacy blob re-chunk migration streams from the
backend with no spool file either.

Legacy removed: store_from_file + mmap CDC analysers + temp-path
plumbing through every port (pre_computed_hash, save_file_from_temp,
update_file_content_from_temp), upload_spool + assembled-file
assembly in both chunked services, create_file/update_file byte-slice
variants (no callers), common::temp, the OXICLOUD_UPLOAD_TMPDIR
config, and the memmap2 dependency.

Verified end-to-end against PostgreSQL 16: 8 MB upload (26 chunks),
identical re-upload (dedup hit, zero writes), 3-byte edit re-upload
(26 chunks, 1 written), byte-identical downloads, Range across chunk
boundaries, concurrent identical-upload race (manifest ref 2), and
trash-empty reclaiming exactly the unshared chunk while the shared 25
survive for the edited file. The empty/sub-8KB multipart path found a
post-EOF re-poll panic in the MIME peek (fixed with fuse + regression
test).

https://claude.ai/code/session_01WdNenpnujNR2sc32XVvwfS

src/infrastructure/repositories/pg/file_blob_write_repository.rs

@@ -220,26 +220,30 @@ impl FileBlobWriteRepository {
         Ok((new_hash.to_string(), updated_at))
     }
 
-    /// Like [`FileWritePort::save_file_from_temp`] but also returns whether the
-    /// blob was genuinely new (`true`) or a dedup hit (`false`).
-    /// Used by [`FileUploadService`] to pass `is_new_blob` to lifecycle hooks.
-    pub async fn save_file_from_temp_with_dedup(
+    /// Register a file row pointing at a blob already stored in the chunk
+    /// store (the upload-ingest layer streamed the content in). Consumes the
+    /// caller's blob reference: any failure releases it before returning.
+    async fn save_file_with_blob_impl(
         &self,
         name: String,
         folder_id: Option<String>,
         content_type: String,
-        temp_path: &std::path::Path,
+        blob_hash: &str,
         size: u64,
-        pre_computed_hash: Option<String>,
-    ) -> Result<(File, bool), DomainError> {
-        let user_id = self.resolve_user_id(folder_id.as_deref()).await?;
-
-        let dedup_result = self
-            .dedup
-            .store_from_file(temp_path, Some(content_type.clone()), pre_computed_hash)
-            .await?;
-        let is_new_blob = !dedup_result.was_deduplicated();
-        let blob_hash = dedup_result.hash().to_string();
+    ) -> Result<File, DomainError> {
+        let user_id = match self.resolve_user_id(folder_id.as_deref()).await {
+            Ok(user_id) => user_id,
+            Err(e) => {
+                if let Err(rollback_err) = self.dedup.remove_reference(blob_hash).await {
+                    tracing::error!(
+                        "Blob orphaned after owner resolution failure — hash: {}, err: {}",
+                        &blob_hash[..12],
+                        rollback_err
+                    );
+                }
+                return Err(e);
+            }
+        };
 
         // Deadlock victims (40P01) retry before the compensation below runs —
         // a successful retry must keep the blob reference alive. The final
@@ -259,7 +263,7 @@ impl FileBlobWriteRepository {
             .bind(&name)
             .bind(&folder_id)
             .bind(user_id)
-            .bind(&blob_hash)
+            .bind(blob_hash)
             .bind(size as i64)
             .bind(&content_type)
             .bind(category_order_for(&name, &content_type))
@@ -269,7 +273,7 @@ impl FileBlobWriteRepository {
         {
             Ok(row) => row,
             Err(e) => {
-                if let Err(rollback_err) = self.dedup.remove_reference(&blob_hash).await {
+                if let Err(rollback_err) = self.dedup.remove_reference(blob_hash).await {
                     tracing::error!(
                         "Blob orphaned after failed INSERT — hash: {}, err: {}",
                         &blob_hash[..12],
@@ -309,32 +313,23 @@ impl FileBlobWriteRepository {
             row.1,
             row.2,
             Some(user_id),
-            blob_hash,
+            blob_hash.to_string(),
         )?;
-        Ok((file, is_new_blob))
+        Ok(file)
     }
 }
 
 impl FileWritePort for FileBlobWriteRepository {
-    async fn save_file_from_temp(
+    async fn save_file_with_blob(
         &self,
         name: String,
         folder_id: Option<String>,
         content_type: String,
-        temp_path: &std::path::Path,
+        blob_hash: &str,
         size: u64,
-        pre_computed_hash: Option<String>,
     ) -> Result<File, DomainError> {
-        self.save_file_from_temp_with_dedup(
-            name,
-            folder_id,
-            content_type,
-            temp_path,
-            size,
-            pre_computed_hash,
-        )
-        .await
-        .map(|(file, _)| file)
+        self.save_file_with_blob_impl(name, folder_id, content_type, blob_hash, size)
+            .await
     }
 
     async fn move_file(
@@ -532,24 +527,18 @@ impl FileWritePort for FileBlobWriteRepository {
         Ok(())
     }
 
-    async fn update_file_content_from_temp(
+    async fn update_file_content_with_blob(
         &self,
         file_id: &str,
-        temp_path: &std::path::Path,
+        blob_hash: &str,
         size: u64,
-        content_type: Option<String>,
-        pre_computed_hash: Option<String>,
         modified_at: Option<i64>,
     ) -> Result<(String, i64), DomainError> {
-        // Streaming: pass pre-computed hash so dedup skips re-reading the file.
-        let dedup_result = self
-            .dedup
-            .store_from_file(temp_path, content_type, pre_computed_hash)
-            .await?;
-        let new_hash = dedup_result.hash().to_string();
-
+        // The content was already ingested into the chunk store by the
+        // upload-ingest layer; swap_blob_hash consumes its reference and
+        // releases it on failure.
         let swapped = self
-            .swap_blob_hash(file_id, &new_hash, size as i64, modified_at)
+            .swap_blob_hash(file_id, blob_hash, size as i64, modified_at)
             .await?;
         // The file now maps to a different blob — drop the read-side cache
         // entry so streaming downloads cannot serve the previous content