perf: migrate all user/session/auth IDs from VARCHAR(36) to native UUID

- Schema: all ~15 VARCHAR(36) columns → UUID with DEFAULT gen_random_uuid()
- Domain entities: User, Session, DeviceCode, AppPassword, Share → id: Uuid
- DTOs: CurrentUser.id → Uuid (API boundary DTOs keep String for JSON)
- Auth middleware: parse JWT claims.sub (String) → Uuid at boundary
- All repository traits, port traits, service impls updated end-to-end
- Handlers: pass Uuid by value (Copy, 16 bytes) instead of String refs
- Settings chain: updated_by column → Uuid (was text, caused setup crash)
- Removed ~650 lines of String↔Uuid conversion boilerplate
- Eliminates per-request heap allocations for ID cloning
- 16-byte binary comparison vs 36-byte string comparison in all queries
- Native UUID indexing in PostgreSQL (btree on 16 bytes vs 36-char text)

85 files changed, 1090 insertions(+), 1739 deletions(-)

src/domain/repositories/address_book_repository.rs

@@ -22,23 +22,23 @@ pub trait AddressBookRepository: Send + Sync + 'static {
     ) -> AddressBookRepositoryResult<Option<AddressBook>>;
     async fn get_address_books_by_owner(
         &self,
-        owner_id: &str,
+        owner_id: Uuid,
     ) -> AddressBookRepositoryResult<Vec<AddressBook>>;
     async fn get_shared_address_books(
         &self,
-        user_id: &str,
+        user_id: Uuid,
     ) -> AddressBookRepositoryResult<Vec<AddressBook>>;
     async fn get_public_address_books(&self) -> AddressBookRepositoryResult<Vec<AddressBook>>;
     async fn share_address_book(
         &self,
         address_book_id: &Uuid,
-        user_id: &str,
+        user_id: Uuid,
         can_write: bool,
     ) -> AddressBookRepositoryResult<()>;
     async fn unshare_address_book(
         &self,
         address_book_id: &Uuid,
-        user_id: &str,
+        user_id: Uuid,
     ) -> AddressBookRepositoryResult<()>;
     async fn get_address_book_shares(
         &self,

src/domain/repositories/calendar_repository.rs

@@ -21,20 +21,20 @@ pub trait CalendarRepository: Send + Sync + 'static {
     /// Lists all calendars for a specific user
     async fn list_calendars_by_owner(
         &self,
-        owner_id: &str,
+        owner_id: Uuid,
     ) -> CalendarRepositoryResult<Vec<Calendar>>;
 
     /// Finds a calendar by name and owner
     async fn find_calendar_by_name_and_owner(
         &self,
         name: &str,
-        owner_id: &str,
+        owner_id: Uuid,
     ) -> CalendarRepositoryResult<Calendar>;
 
     /// Lists calendars shared with a specific user
     async fn list_calendars_shared_with_user(
         &self,
-        user_id: &str,
+        user_id: Uuid,
     ) -> CalendarRepositoryResult<Vec<Calendar>>;
 
     /// List public calendars
@@ -48,7 +48,7 @@ pub trait CalendarRepository: Send + Sync + 'static {
     async fn user_has_calendar_access(
         &self,
         calendar_id: &Uuid,
-        user_id: &str,
+        user_id: Uuid,
     ) -> CalendarRepositoryResult<bool>;
 
     /// Gets a custom property for a calendar
@@ -83,7 +83,7 @@ pub trait CalendarRepository: Send + Sync + 'static {
     async fn share_calendar(
         &self,
         calendar_id: &Uuid,
-        user_id: &str,
+        user_id: Uuid,
         access_level: &str,
     ) -> CalendarRepositoryResult<()>;
 
@@ -91,7 +91,7 @@ pub trait CalendarRepository: Send + Sync + 'static {
     async fn remove_calendar_sharing(
         &self,
         calendar_id: &Uuid,
-        user_id: &str,
+        user_id: Uuid,
     ) -> CalendarRepositoryResult<()>;
 
     /// Get calendar sharing information (who has access to this calendar)

src/domain/repositories/session_repository.rs

@@ -1,5 +1,6 @@
 use crate::common::errors::DomainError;
 use crate::domain::entities::session::Session;
+use uuid::Uuid;
 
 #[derive(Debug, thiserror::Error)]
 pub enum SessionRepositoryError {
@@ -33,7 +34,7 @@ pub trait SessionRepository: Send + Sync + 'static {
     async fn create_session(&self, session: Session) -> SessionRepositoryResult<Session>;
 
     /// Gets a session by ID
-    async fn get_session_by_id(&self, id: &str) -> SessionRepositoryResult<Session>;
+    async fn get_session_by_id(&self, id: Uuid) -> SessionRepositoryResult<Session>;
 
     /// Gets a session by refresh token
     async fn get_session_by_refresh_token(
@@ -42,14 +43,14 @@ pub trait SessionRepository: Send + Sync + 'static {
     ) -> SessionRepositoryResult<Session>;
 
     /// Gets all sessions for a user
-    async fn get_sessions_by_user_id(&self, user_id: &str)
+    async fn get_sessions_by_user_id(&self, user_id: Uuid)
     -> SessionRepositoryResult<Vec<Session>>;
 
     /// Revokes a specific session
-    async fn revoke_session(&self, session_id: &str) -> SessionRepositoryResult<()>;
+    async fn revoke_session(&self, session_id: Uuid) -> SessionRepositoryResult<()>;
 
     /// Revokes all sessions for a user
-    async fn revoke_all_user_sessions(&self, user_id: &str) -> SessionRepositoryResult<u64>;
+    async fn revoke_all_user_sessions(&self, user_id: Uuid) -> SessionRepositoryResult<u64>;
 
     /// Deletes expired sessions
     async fn delete_expired_sessions(&self) -> SessionRepositoryResult<u64>;

src/domain/repositories/settings_repository.rs

@@ -1,5 +1,6 @@
 use crate::common::errors::DomainError;
 use std::collections::HashMap;
+use uuid::Uuid;
 
 /// Repository for platform settings stored in the database.
 /// Settings are key-value pairs organized by category (e.g., "oidc", "general").
@@ -18,7 +19,7 @@ pub trait SettingsRepository: Send + Sync + 'static {
         value: &str,
         category: &str,
         is_secret: bool,
-        updated_by: Option<&str>,
+        updated_by: Option<Uuid>,
     ) -> Result<(), DomainError>;
 
     /// Delete a setting by key
@@ -34,7 +35,7 @@ pub trait SettingsRepository: Send + Sync + 'static {
     /// The default implementation falls back to the non-atomic
     /// get-then-set pattern for repositories that don't support a native
     /// atomic upsert.
-    async fn try_claim_initialization(&self, admin_user_id: &str) -> Result<bool, DomainError> {
+    async fn try_claim_initialization(&self, admin_user_id: Uuid) -> Result<bool, DomainError> {
         // Default: non-atomic fallback (overridden by PG implementation)
         match self.get("system_initialized").await? {
             Some(v) if v == "true" => Ok(false),

src/domain/repositories/share_repository.rs

@@ -1,4 +1,5 @@
 use thiserror::Error;
+use uuid::Uuid;
 
 use crate::domain::{
     entities::share::{Share, ShareItemType},
@@ -24,7 +25,7 @@ pub trait ShareRepository: Send + Sync + 'static {
     async fn save(&self, share: &Share) -> Result<Share, ShareRepositoryError>;
 
     /// Find a share by its ID
-    async fn find_by_id(&self, id: &str) -> Result<Share, ShareRepositoryError>;
+    async fn find_by_id(&self, id: Uuid) -> Result<Share, ShareRepositoryError>;
 
     /// Find a share by its token
     async fn find_by_token(&self, token: &str) -> Result<Share, ShareRepositoryError>;
@@ -37,10 +38,10 @@ pub trait ShareRepository: Send + Sync + 'static {
     ) -> Result<Vec<Share>, ShareRepositoryError>;
 
     /// Delete a share by its ID
-    async fn delete(&self, id: &str) -> Result<(), ShareRepositoryError>;
+    async fn delete(&self, id: Uuid) -> Result<(), ShareRepositoryError>;
 
     /// Find all shares created by a specific user
-    async fn find_by_user(&self, user_id: &str) -> Result<Vec<Share>, ShareRepositoryError>;
+    async fn find_by_user(&self, user_id: Uuid) -> Result<Vec<Share>, ShareRepositoryError>;
 
     /// Find all shares (admin operation)
     async fn find_all(&self) -> Result<Vec<Share>, ShareRepositoryError>;

src/domain/repositories/user_repository.rs

@@ -1,5 +1,6 @@
 use crate::common::errors::DomainError;
 use crate::domain::entities::user::{User, UserRole};
+use uuid::Uuid;
 
 #[derive(Debug, thiserror::Error)]
 pub enum UserRepositoryError {
@@ -45,7 +46,7 @@ pub trait UserRepository: Send + Sync + 'static {
     async fn create_user(&self, user: User) -> UserRepositoryResult<User>;
 
     /// Gets a user by ID
-    async fn get_user_by_id(&self, id: &str) -> UserRepositoryResult<User>;
+    async fn get_user_by_id(&self, id: Uuid) -> UserRepositoryResult<User>;
 
     /// Gets a user by username
     async fn get_user_by_username(&self, username: &str) -> UserRepositoryResult<User>;
@@ -59,12 +60,12 @@ pub trait UserRepository: Send + Sync + 'static {
     /// Updates only a user's storage usage
     async fn update_storage_usage(
         &self,
-        user_id: &str,
+        user_id: Uuid,
         usage_bytes: i64,
     ) -> UserRepositoryResult<()>;
 
     /// Updates the last login date
-    async fn update_last_login(&self, user_id: &str) -> UserRepositoryResult<()>;
+    async fn update_last_login(&self, user_id: Uuid) -> UserRepositoryResult<()>;
 
     /// Lists users with pagination
     async fn list_users(&self, limit: i64, offset: i64) -> UserRepositoryResult<Vec<User>>;
@@ -73,21 +74,21 @@ pub trait UserRepository: Send + Sync + 'static {
     async fn search_users(&self, query: &str, limit: i64) -> UserRepositoryResult<Vec<User>>;
 
     /// Activates or deactivates a user
-    async fn set_user_active_status(&self, user_id: &str, active: bool)
+    async fn set_user_active_status(&self, user_id: Uuid, active: bool)
     -> UserRepositoryResult<()>;
 
     /// Changes a user's password
-    async fn change_password(&self, user_id: &str, password_hash: &str)
+    async fn change_password(&self, user_id: Uuid, password_hash: &str)
     -> UserRepositoryResult<()>;
 
     /// Changes a user's role
-    async fn change_role(&self, user_id: &str, role: UserRole) -> UserRepositoryResult<()>;
+    async fn change_role(&self, user_id: Uuid, role: UserRole) -> UserRepositoryResult<()>;
 
     /// Lists users by role (admin or user)
     async fn list_users_by_role(&self, role: &str) -> UserRepositoryResult<Vec<User>>;
 
     /// Deletes a user
-    async fn delete_user(&self, user_id: &str) -> UserRepositoryResult<()>;
+    async fn delete_user(&self, user_id: Uuid) -> UserRepositoryResult<()>;
 
     /// Finds a user by OIDC provider + subject pair
     async fn get_user_by_oidc_subject(
@@ -99,7 +100,7 @@ pub trait UserRepository: Send + Sync + 'static {
     /// Updates a user's storage quota
     async fn update_storage_quota(
         &self,
-        user_id: &str,
+        user_id: Uuid,
         quota_bytes: i64,
     ) -> UserRepositoryResult<()>;