fix: critical bugs from deep audit

- Fix copy_files() data loss: implement real copy_file across full stack
  (FileWritePort, FileManagementUseCase, stubs, service, repository with
  atomic CTE + dedup ref_count increment, batch_operations caller)
- Fix plaintext password in replace_default_admin: hash password via
  PasswordHasherPort before User::new()
- Fix CalendarService hardcoded user_id: unify CalendarUseCase trait with
  explicit user_id parameter on all methods, remove zombie _for_user
  duplicates and hardcoded 'current_user_id', update 20 CalDAV handler
  call sites
- Previous session: migrate DedupService to PostgreSQL (storage.blobs),
  atomic CTEs with compensation for file/folder repository operations

src/application/ports/storage_ports.rs

@@ -115,6 +115,16 @@ pub trait FileWritePort: Send + Sync + 'static {
         size: u64,
     ) -> Result<(File, PathBuf), DomainError>;
 
+    /// Copies a file to a (possibly different) folder.
+    ///
+    /// With blob-dedup, this only creates a new metadata row and increments
+    /// the blob reference count — zero disk I/O for the content.
+    async fn copy_file(
+        &self,
+        file_id: &str,
+        target_folder_id: Option<String>,
+    ) -> Result<File, DomainError>;
+
     // ── Trash operations ──
 
     /// Moves a file to the trash