Optimize encryption, storage, and media streaming performance (#447)

- AES-256-GCM in-place decryption halves peak RAM in encrypted blob backend
- Offload crypto ≥64 KiB to spawn_blocking (unblocks async runtime)
- Fix off-by-one in encrypted range stream (end now exclusive)
- Collapse 3 DB round-trips for quota updates into 1 correlated UPDATE
- Set-based reconciliation sweep replaces per-user task spawning
- Eliminate entity re-read after file overwrite via RETURNING clause
- Lightbox streams video/photos inline instead of fetch→blob

src/common/stubs.rs

@@ -193,8 +193,8 @@ impl FileWritePort for StubFileWritePort {
         _content_type: Option<String>,
         _pre_computed_hash: Option<String>,
         _modified_at: Option<i64>,
-    ) -> Result<String, DomainError> {
-        Ok(String::new())
+    ) -> Result<(String, i64), DomainError> {
+        Ok((String::new(), 0))
     }
 
     async fn register_file_deferred(