perf: round 24 — download_zip per-item authz+metadata N+1 → batch (validated authorization pass)

The ROUND23-deferred download_zip N+1, given its own validated pass. The
individually-selected files were authorized + fetched one at a time via
get_file_with_perms (require + get = 2 serial round-trips/file) before any
streaming — a 200-file selection was 400 serial round-trips. AFTER routes the
whole multi-select through the new
FileRetrievalService::get_files_by_ids_with_perms: one check_files_read_batch
(the PgAclEngine resolves every file's drive in ONE query and primes the
resource->drive cache) + one get_files_by_ids. 2N round-trips -> 2.

Authorization is unchanged and still enforced BEFORE any ZIP entry is written:
- add_file_entry_streamed writes the entry header (the filename) before it opens
  the authorized stream, so the pre-filter is load-bearing — a denied file must
  never reach it or its name leaks into the archive. AFTER a denied/missing id
  is absent from the authorized map and is skipped in the same input order,
  exactly as the old loop skipped a denied get_file_with_perms; it never reaches
  the entry write. The authz moved from a per-file require to one batch check
  EARLIER in the same function, not into or after the stream.
- The stream open keeps its own per-file Read check (now a primed-cache hit) +
  Recents recording; check_files_read_batch is documented + gated as identical
  to looping require.

Because the change is authorization-sensitive, the gate is the security property
itself. bench_round24_zip_authz drives the real PgAclEngine over a seeded,
interleaved mix of owned (granted drive) + denied (other drive) + missing ids
and asserts: the batch inclusion set AND input order are identical to the
per-file require loop; the included set is exactly the caller's owned files; no
denied or missing id is ever included (the authz-regression tripwire); and the
batch fetch returns exactly the owned files. Latency (cold, 600-item 1/3-owned
selection): 559 -> 267 ms (2.10x; the realistic all-owned selection is O(1) ->
a larger win). See benches/ROUND24.md.

The folder selections are left as-is (root counts are small and there is no
check_folders_read_batch primitive to batch through).

Verified: cargo clippy --features bench --all-targets -D warnings clean, cargo
fmt --all --check clean, cargo test --lib --features bench = 529 passed / 0
failed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DKyQ4AnYtgp1JtjzweyMeo

src/application/services/file_retrieval_service.rs

@@ -287,6 +287,52 @@ impl FileRetrievalService {
         Ok(files.into_iter().map(FileDto::from).collect())
     }
 
+    /// Batched, authorized multi-get for the ZIP-download multi-select — the
+    /// batch form of [`FileRetrievalUseCase::get_file_with_perms`] over an
+    /// explicit id list.
+    ///
+    /// Authorizes `Read` on every id in ONE `check_files_read_batch`
+    /// round-trip (which resolves all drives in a single query AND primes the
+    /// resource→drive cache, so the per-file re-check the subsequent stream
+    /// open performs becomes a cache hit), then fetches only the authorized ids
+    /// in ONE `get_files_by_ids` query. Replaces `download_zip`'s per-file
+    /// `require_file` + `get_file` loop — 2 round-trips/file → 2 total.
+    ///
+    /// Returns the authorized, existing files; a denied / missing / unparseable
+    /// id is simply **absent** from the result (the caller re-associates by id
+    /// and skips the rest, exactly as the per-file loop skipped a denied /
+    /// missing `get_file_with_perms`). Read-authorization is identical to the
+    /// per-file path (`check_files_read_batch` is documented and gated as
+    /// semantically identical to looping `require`). Recents recording is left
+    /// to the subsequent per-file stream open (`get_file_stream_with_perms`),
+    /// which records it (throttle-coalesced) — same net effect as the old
+    /// loop's `notify_file_accessed` + stream double-notify. Fail-closed if no
+    /// engine was injected, mirroring [`Self::require_file`].
+    pub async fn get_files_by_ids_with_perms(
+        &self,
+        ids: &[String],
+        caller_id: Uuid,
+    ) -> Result<Vec<FileDto>, DomainError> {
+        let authz = self.authz.as_ref().ok_or_else(|| {
+            DomainError::internal_error("FileRetrieval", "Authorization engine unavailable")
+        })?;
+        // Unparseable ids can't be authorized (the per-file path 404s on them),
+        // so drop them here — they stay absent from the authorized set.
+        let uuids: Vec<Uuid> = ids.iter().filter_map(|s| Uuid::parse_str(s).ok()).collect();
+        if uuids.is_empty() {
+            return Ok(Vec::new());
+        }
+        let allowed = authz
+            .check_files_read_batch(Subject::User(caller_id), &uuids)
+            .await?;
+        if allowed.is_empty() {
+            return Ok(Vec::new());
+        }
+        let allowed_ids: Vec<String> = allowed.iter().map(Uuid::to_string).collect();
+        let files = self.file_read.get_files_by_ids(&allowed_ids).await?;
+        Ok(files.into_iter().map(FileDto::from).collect())
+    }
+
     /// Range read for HTTP Range Requests, cache-aware.
     ///
     /// Media players and PDF viewers fetch these files *exclusively* through