perf: round 12 — auth write-path narrowing, fused quota gate, moka blob-cache index, media single-read, sized listing JSON

Benchmark-gated round (benches/ROUND12.md; every change ships with a
BEFORE/AFTER harness + equivalence gates, one candidate rejected by its
own bench):

DB / query shapes (bench_round12_queries):
- NC sharee search: username-only projection instead of the 21-column row
  (incl. the <=512 KiB avatar) per match, + gin_trgm_ops indexes on
  auth.users for the leading-wildcard ILIKE (4.98x; 54.7x with index).
- Password login: delete the redundant full-row update_user — create_session
  already stamps last_login_at in its own txn (4.45x per login).
- Email-verified stamp: narrow conditional UPDATE (8.9x); OIDC repeat login
  now compares profile state in memory and issues ZERO queries when nothing
  changed (was: full 17-column rewrite per login).
- Refresh rotation: revoke+insert+stamp fused into one transaction via new
  rotate_session port method (1.18x).
- WOPI CheckFileInfo / authorize_wopi_access: require(Read) + get_file +
  check(Update) overlapped with tokio::join!, original result precedence
  (cold 1.34x).
- Upload quota gate: user-envelope + drive-cap checks fused into ONE
  round-trip (check_upload_quotas) — the NC chunked PUT pays this per
  chunk (1.81x, 2 -> 1 queries/chunk); shared verdict evaluators keep
  error shapes byte-identical.

CPU / allocs (bench_round12_micro):
- sized_json: pre-sized listing serialization replacing axum Json's 128 B
  seed + doubling-realloc chain on files/folder-resources/photos/search
  responses (1.40x, 13 -> 2 allocs per 500-row page; byte-identical).
- Security headers: 4 SetResponseHeaderLayer folded into the CSP middleware
  pass (5 layers -> 1; 1.43x per request, -26 allocs; header set gated
  byte-identical incl. 304s).
- Media capture-metadata: single-read extraction — nom-exif now parses the
  buffer kamadak already read (zero-copy Bytes) and videos open once with a
  kind() dispatch; per-image opens 2-3 -> 1 (1.44x warm geomean, 1.6-3.2x
  cold cache; extraction outputs gated identical incl. the MIME-mislabel
  track fallback).
- Chunked-upload session ops: owner gate folded into the operation's own
  DashMap lookup + stack-encoded uuid compare (5 -> 3 lookups, -2 allocs,
  1.28x per chunk).

Blob cache (bench_blob_cache_index + round-3 regression guard):
- CachedBlobBackend index: tokio::sync::Mutex<LruCache> -> moka::sync::Cache
  with byte weigher. The mutex serialized every cached chunk read and scaled
  NEGATIVELY (2.08 -> 1.07 Mops/s from 1 -> 2 readers); moka probes are
  lock-free (2.17x at K=2). Byte budget now enforced by moka (manual
  current_size + collect_evictions machinery deleted); eviction listener
  unlinks size-evicted files only (Replaced entries keep their file —
  gated). Single-flight miss gate unchanged (16 concurrent misses -> 1
  fetch re-verified via the round-3 harness).
- put_blob now populates the cache BEFORE the inner backend consumes the
  source file (the old order failed 100% of the time — local renames,
  S3/Azure delete the source — so the first read after a whole-file put
  re-downloaded from the remote); inner-put failure invalidates the entry.

Frontend (vitest gates):
- List-view thumbnails request the 150px icon rendition instead of 400px
  preview into a 40px slot (~7.1x fewer pixels, ~4-5x fewer bytes per
  thumbnail across list views); grid keeps preview.

Rejected by its own bench (kept as evidence in bench_round12_micro §2):
- Single-pass compression predicate: the monomorphized And-chain already
  costs ~4.6 ns / 0 allocs total; the fused node measured within noise.

New migration: 20260719000000_users_search_trgm.sql (trgm indexes).
Deferred with prepared design: grouped file/grid view virtualization
(single-VirtualRows flatten, the photos pattern) — next round's headline.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfidAJD5AHw23jtvBUNamB

src/interfaces/nextcloud/ocs_handler.rs

@@ -342,20 +342,21 @@ pub async fn handle_sharees_search(
         None => return sharees_response(vec![]).into_response(),
     };
 
-    // SQL-level ILIKE search with limit — avoids loading all users into memory.
-    let users = auth_service
-        .search_users(&search, 26)
+    // SQL-level ILIKE search with limit — avoids loading all users into
+    // memory. Username-only projection: the wide `search_users` row drags
+    // the up-to-512 KiB avatar `image` per matched user, per keystroke
+    // (benches/ROUND12.md §1). NULL-username (email-only signup) rows are
+    // already filtered by the service, preserving the old post-limit
+    // filtering semantics.
+    let usernames = auth_service
+        .search_sharee_usernames(&search, 26)
         .await
         .unwrap_or_default();
 
-    // Skip users with no claimed username — NC sharees autocomplete relies
-    // on a username being typeable; users still on the email-only signup
-    // path can't be addressed here. Also skip self (don't suggest sharing
-    // with yourself).
-    let matches: Vec<serde_json::Value> = users
+    // Skip self (don't suggest sharing with yourself).
+    let matches: Vec<serde_json::Value> = usernames
         .into_iter()
-        .filter_map(|u| {
-            let handle = u.username.clone()?;
+        .filter_map(|handle| {
             if handle.as_str() == &*user.username {
                 return None;
             }

src/interfaces/nextcloud/uploads_handler.rs

@@ -7,7 +7,6 @@ use std::sync::Arc;
 use uuid::Uuid;
 
 use crate::application::ports::file_ports::FileUploadUseCase;
-use crate::application::ports::storage_ports::StorageUsagePort;
 use crate::common::di::AppState;
 use crate::common::mime_detect::filename_from_path;
 use crate::interfaces::errors::AppError;
@@ -52,10 +51,10 @@ async fn refuse_if_over_quota(
         // remains authoritative.
         return Ok(());
     };
-    svc.check_storage_quota(user_id, additional)
-        .await
-        .map_err(AppError::from)?;
-    svc.check_drive_quota(drive_id, additional)
+    // Fused single round-trip (user envelope + drive cap) — this gate runs
+    // on EVERY chunk PUT, and the serial pair cost two point reads per
+    // chunk (benches/ROUND12.md §6). Verdict precedence unchanged.
+    svc.check_upload_quotas(user_id, drive_id, additional)
         .await
         .map_err(AppError::from)
 }