perf: round 4 — one-pass row paths, drive-selector cache, CalDAV single-parse, streamed Azure, batched hydration

Nine benchmark-gated changes (benches/ROUND4.md; every one ships with a
BEFORE/AFTER bench + equivalence gate, rollback rule as ROUND2/3):

- Row→entity path build: one-pass StoragePath::from_folder_and_name /
  from_joined + normalize_storage_name_owned + alloc-free Display —
  743→417 ns/file-row (1.78x), −5 allocs/row on every listing surface.
- WebDAV drive-selector: per-user readable_cache (single-flight, 30 s
  TTL, explicit invalidation incl. membership + group changes) replaces
  the grants join per request — 441 µs → 0.8 µs (~550x), 0 queries warm.
- CalDAV from_ical/update_ical_data: 8 full IcalParser runs per VEVENT
  → 1 (7.1x per PUT, 4.4x on 50-event imports); alloc-free split_vevents,
  chunk scan without the whole-body uppercase copy (1.4x), borrowed-key
  UID grouping (1.3x), REPORT props no longer cloned.
- PROPFIND emit: partition Vecs dropped (single-pass 404 list) + stack
  rendered RFC 3339/2822 dates, sizes, quoted etags (common::fmt,
  chrono-byte-identical, sweep-tested) on both DAV surfaces — 1.22x
  per page, 17.9→12.0 allocs/row.
- Grant-listing hydration: calendars/address books/playlists batch
  hydrate via = ANY($1) — 15 serial queries → 1 (~13x per sync poll).
- user-flags cache: get→insert → try_get_with single-flight (32→1
  queries per cold herd).
- Azure downloads: whole-blob Vec buffering → streamed SDK pages —
  TTFB 349→4 ms (87x), peak heap 480→1.9 MiB (254x) on 256 MiB blobs;
  new OXICLOUD_AZURE_ENDPOINT_URL override (Azurite/bench hook).
- Face indexing: unbounded per-image tokio::spawn → core-count
  semaphore, permit before blob read — peak heap 1175→176 MiB (6.7x).

Checks: cargo fmt, clippy --all-features --all-targets -D warnings,
cargo test --workspace (523 passed) + --features test_utils. hurl API
suite and dockerized integration DB not runnable in this environment —
left to CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017aJu9ghvuT8WqC31ZEGTBA

src/application/services/auth_application_service.rs

@@ -147,8 +147,12 @@ pub struct AuthApplicationService {
     /// request. The short TTL keeps the "role changes apply without token
     /// rotation" property within seconds while removing one DB round-trip
     /// per request; the known mutation paths (`change_user_role`,
-    /// `set_user_active`) also invalidate eagerly.
-    user_flags_cache: Cache<Uuid, UserFlags>,
+    /// `set_user_active`) also invalidate eagerly. `moka::future` so
+    /// concurrent misses for one user coalesce into a single DB lookup
+    /// (`try_get_with` single-flight) — every authenticated request
+    /// calls this, so each 30 s TTL expiry used to fan out one SELECT
+    /// per in-flight request of that user.
+    user_flags_cache: moka::future::Cache<Uuid, UserFlags>,
     /// Self-service auth-method allowlist (mirrors
     /// `AuthConfig::allowed_auth_methods`). Empty = both methods
     /// allowed. Consulted by login / register / magic-link handlers via
@@ -198,7 +202,7 @@ impl AuthApplicationService {
                 .time_to_live(Duration::from_secs(120))
                 .build(),
             magic_link_repo: None,
-            user_flags_cache: Cache::builder()
+            user_flags_cache: moka::future::Cache::builder()
                 .max_capacity(10_000)
                 .time_to_live(USER_FLAGS_CACHE_TTL)
                 .build(),
@@ -1363,7 +1367,7 @@ impl AuthApplicationService {
         // Invalidate the flags cache so subsequent per-request guards
         // observe the new `is_external=false` without waiting for the
         // 30-second TTL. Same pattern as `change_user_role`.
-        self.user_flags_cache.invalidate(&caller_id);
+        self.user_flags_cache.invalidate(&caller_id).await;
 
         // Dispatch — home-drive provisioning happens here. Log-and-
         // continue: a provisioning failure leaves the row updated and
@@ -1508,12 +1512,20 @@ impl AuthApplicationService {
     /// Staleness is bounded by [`USER_FLAGS_CACHE_TTL`]; role and active
     /// changes made through this service invalidate the entry eagerly.
     pub async fn get_user_flags(&self, user_id: Uuid) -> Result<UserFlags, DomainError> {
-        if let Some(flags) = self.user_flags_cache.get(&user_id) {
-            return Ok(flags);
-        }
-        let flags = self.user_storage.get_user_flags(user_id).await?;
-        self.user_flags_cache.insert(user_id, flags);
-        Ok(flags)
+        // Single-flight: concurrent misses for the same user coalesce
+        // into ONE storage lookup; errors are never cached (same herd
+        // shape ROUND3 fixed for basic-auth, minus the Argon2 cost).
+        self.user_flags_cache
+            .try_get_with(user_id, async {
+                Ok::<_, DomainError>(self.user_storage.get_user_flags(user_id).await?)
+            })
+            .await
+            // try_get_with hands back `Arc<DomainError>` shared by all
+            // waiters; DomainError isn't Clone, so rebuild a fresh one
+            // preserving the kind / entity / message.
+            .map_err(|shared: std::sync::Arc<DomainError>| {
+                DomainError::new(shared.kind, shared.entity_type, shared.message.clone())
+            })
     }
 
     /// Apply a profile update on behalf of the calling user (PR 24).
@@ -2226,7 +2238,7 @@ impl AuthApplicationService {
         self.user_storage
             .set_user_active_status(user_id, active)
             .await?;
-        self.user_flags_cache.invalidate(&user_id);
+        self.user_flags_cache.invalidate(&user_id).await;
         Ok(())
     }
 
@@ -2240,7 +2252,7 @@ impl AuthApplicationService {
             ));
         }
         self.user_storage.change_role(user_id, role).await?;
-        self.user_flags_cache.invalidate(&user_id);
+        self.user_flags_cache.invalidate(&user_id).await;
         Ok(())
     }