perf: migrate all user/session/auth IDs from VARCHAR(36) to native UUID

- Schema: all ~15 VARCHAR(36) columns → UUID with DEFAULT gen_random_uuid()
- Domain entities: User, Session, DeviceCode, AppPassword, Share → id: Uuid
- DTOs: CurrentUser.id → Uuid (API boundary DTOs keep String for JSON)
- Auth middleware: parse JWT claims.sub (String) → Uuid at boundary
- All repository traits, port traits, service impls updated end-to-end
- Handlers: pass Uuid by value (Copy, 16 bytes) instead of String refs
- Settings chain: updated_by column → Uuid (was text, caused setup crash)
- Removed ~650 lines of String↔Uuid conversion boilerplate
- Eliminates per-request heap allocations for ID cloning
- 16-byte binary comparison vs 36-byte string comparison in all queries
- Native UUID indexing in PostgreSQL (btree on 16 bytes vs 36-char text)

85 files changed, 1090 insertions(+), 1739 deletions(-)

src/domain/entities/app_password.rs

@@ -11,9 +11,9 @@ use uuid::Uuid;
 #[derive(Debug, Clone)]
 pub struct AppPassword {
     /// Unique identifier.
-    pub id: String,
+    pub id: Uuid,
     /// Owner user ID.
-    pub user_id: String,
+    pub user_id: Uuid,
     /// Human-readable label chosen by the user (e.g. "DAVx5 on Pixel 8").
     pub label: String,
     /// Argon2 hash of the generated password token.
@@ -41,7 +41,7 @@ impl AppPassword {
     /// The caller is responsible for hashing the raw token and passing
     /// the hash and prefix.
     pub fn new(
-        user_id: String,
+        user_id: Uuid,
         label: String,
         password_hash: String,
         prefix: String,
@@ -49,7 +49,7 @@ impl AppPassword {
         expires_at: Option<DateTime<Utc>>,
     ) -> Self {
         Self {
-            id: Uuid::new_v4().to_string(),
+            id: Uuid::new_v4(),
             user_id,
             label,
             password_hash,