perf: migrate all user/session/auth IDs from VARCHAR(36) to native UUID

- Schema: all ~15 VARCHAR(36) columns → UUID with DEFAULT gen_random_uuid()
- Domain entities: User, Session, DeviceCode, AppPassword, Share → id: Uuid
- DTOs: CurrentUser.id → Uuid (API boundary DTOs keep String for JSON)
- Auth middleware: parse JWT claims.sub (String) → Uuid at boundary
- All repository traits, port traits, service impls updated end-to-end
- Handlers: pass Uuid by value (Copy, 16 bytes) instead of String refs
- Settings chain: updated_by column → Uuid (was text, caused setup crash)
- Removed ~650 lines of String↔Uuid conversion boilerplate
- Eliminates per-request heap allocations for ID cloning
- 16-byte binary comparison vs 36-byte string comparison in all queries
- Native UUID indexing in PostgreSQL (btree on 16 bytes vs 36-char text)

85 files changed, 1090 insertions(+), 1739 deletions(-)

src/interfaces/api/handlers/dedup_handler.rs

@@ -99,7 +99,7 @@ impl DedupHandler {
         }
 
         // Only reveal whether THIS user has the blob — no global oracle
-        let user_has_it = dedup.user_owns_blob_reference(&hash, &auth_user.id).await;
+        let user_has_it = dedup.user_owns_blob_reference(&hash, &auth_user.id.to_string()).await;
 
         if user_has_it {
             // Fetch size from metadata (safe — user owns a reference)
@@ -346,7 +346,7 @@ impl DedupHandler {
         }
 
         // Verify the user owns at least one file referencing this blob
-        if !dedup.user_owns_blob_reference(&hash, &auth_user.id).await {
+        if !dedup.user_owns_blob_reference(&hash, &auth_user.id.to_string()).await {
             return Response::builder()
                 .status(StatusCode::NOT_FOUND)
                 .header(header::CONTENT_TYPE, "application/json")