perf: migrate all user/session/auth IDs from VARCHAR(36) to native UUID

- Schema: all ~15 VARCHAR(36) columns → UUID with DEFAULT gen_random_uuid()
- Domain entities: User, Session, DeviceCode, AppPassword, Share → id: Uuid
- DTOs: CurrentUser.id → Uuid (API boundary DTOs keep String for JSON)
- Auth middleware: parse JWT claims.sub (String) → Uuid at boundary
- All repository traits, port traits, service impls updated end-to-end
- Handlers: pass Uuid by value (Copy, 16 bytes) instead of String refs
- Settings chain: updated_by column → Uuid (was text, caused setup crash)
- Removed ~650 lines of String↔Uuid conversion boilerplate
- Eliminates per-request heap allocations for ID cloning
- 16-byte binary comparison vs 36-byte string comparison in all queries
- Native UUID indexing in PostgreSQL (btree on 16 bytes vs 36-char text)

85 files changed, 1090 insertions(+), 1739 deletions(-)

src/interfaces/api/handlers/trash_handler.rs

@@ -18,7 +18,7 @@ pub async fn get_trash_items(
     // SECURITY: Always use the authenticated user's ID from the JWT token.
     // Never allow user ID override via query parameters to prevent
     // privilege escalation attacks.
-    let effective_user = auth_user.id.clone();
+    let effective_user = auth_user.id;
 
     debug!("Request to list trash items for user {}", effective_user);
 
@@ -34,7 +34,7 @@ pub async fn get_trash_items(
         }
     };
 
-    let result = trash_service.get_trash_items(&effective_user).await;
+    let result = trash_service.get_trash_items(effective_user).await;
 
     match result {
         Ok(items) => {
@@ -60,7 +60,7 @@ pub async fn move_file_to_trash(
     auth_user: AuthUser,
     Path(item_id): Path<String>,
 ) -> (StatusCode, Json<serde_json::Value>) {
-    let user_id = &auth_user.id;
+    let user_id = auth_user.id;
     debug!(
         "Request to move file to trash: id={}, user={}",
         item_id, user_id
@@ -111,7 +111,7 @@ pub async fn move_folder_to_trash(
     auth_user: AuthUser,
     Path(item_id): Path<String>,
 ) -> (StatusCode, Json<serde_json::Value>) {
-    let user_id = &auth_user.id;
+    let user_id = auth_user.id;
     debug!(
         "Request to move folder to trash: id={}, user={}",
         item_id, user_id
@@ -177,7 +177,7 @@ pub async fn restore_from_trash(
             );
         }
     };
-    let result = trash_service.restore_item(&trash_id, &auth_user.id).await;
+    let result = trash_service.restore_item(&trash_id, auth_user.id).await;
 
     match result {
         Ok(_) => {
@@ -239,7 +239,7 @@ pub async fn delete_permanently(
         }
     };
     let result = trash_service
-        .delete_permanently(&trash_id, &auth_user.id)
+        .delete_permanently(&trash_id, auth_user.id)
         .await;
 
     match result {
@@ -300,7 +300,7 @@ pub async fn empty_trash(
             );
         }
     };
-    let result = trash_service.empty_trash(&auth_user.id).await;
+    let result = trash_service.empty_trash(auth_user.id).await;
 
     match result {
         Ok(_) => {