Optimize encryption, storage, and media streaming performance (#447)

- AES-256-GCM in-place decryption halves peak RAM in encrypted blob backend
- Offload crypto ≥64 KiB to spawn_blocking (unblocks async runtime)
- Fix off-by-one in encrypted range stream (end now exclusive)
- Collapse 3 DB round-trips for quota updates into 1 correlated UPDATE
- Set-based reconciliation sweep replaces per-user task spawning
- Eliminate entity re-read after file overwrite via RETURNING clause
- Lightbox streams video/photos inline instead of fetch→blob

src/application/ports/blob_storage_ports.rs

@@ -95,7 +95,10 @@ pub trait BlobStorageBackend: Send + Sync + 'static {
     /// Stream the full blob content in chunks.
     fn get_blob_stream(&self, hash: &str) -> BoxFut<'_, Result<BlobStream, DomainError>>;
 
-    /// Stream a byte range of the blob (for HTTP Range requests / video seek).
+    /// Stream the byte range `[start, end)` of the blob (for HTTP Range
+    /// requests / video seek). `end` is **exclusive**; `None` means "to the
+    /// end of the blob". Callers translating inclusive HTTP Range headers
+    /// must pass `last_byte + 1`.
     fn get_blob_range_stream(
         &self,
         hash: &str,

src/application/ports/storage_ports.rs

@@ -286,6 +286,10 @@ pub trait FileWritePort: Send + Sync + 'static {
     /// When `pre_computed_hash` is provided, the dedup service skips the
     /// hash re-read — zero extra I/O beyond the initial spool.
     /// Peak RAM: ~256 KB regardless of file size.
+    ///
+    /// Returns `(new_blob_hash, updated_at_epoch)` — everything a caller
+    /// needs to rebuild the fresh entity/ETag from a `File` it already
+    /// holds, without re-reading the row it just updated.
     async fn update_file_content_from_temp(
         &self,
         file_id: &str,
@@ -294,7 +298,7 @@ pub trait FileWritePort: Send + Sync + 'static {
         content_type: Option<String>,
         pre_computed_hash: Option<String>,
         modified_at: Option<i64>,
-    ) -> Result<String, DomainError>;
+    ) -> Result<(String, i64), DomainError>;
 
     /// Registers file metadata WITHOUT writing content to disk (write-behind).
     ///