perf: round 5 — CalDAV cursor streaming, SPA interning gaps, NC href prefix, per-request micro-allocs

Seven benchmark-gated changes (benches/ROUND5.md; BEFORE/AFTER bench +
equivalence gate each, rollback rule as ROUND2-4 — two intermediate
CalDAV shapes measured worse and were themselves rolled back before
shipping):

- CalDAV whole-calendar responses (REPORT no-range/sync-collection,
  depth-1 collection PROPFIND, .ics GET): buffered double-residency →
  ONE window-ordered scan (MIN(start_time) OVER (PARTITION BY ical_uid))
  streamed through a PG cursor, pages cut at UID boundaries. TTFB
  23.3→11.0 ms (2.1x), peak heap 14.2→8.0 MiB at 4k events / 45→24 MiB
  at 12k, wall +9-15% (documented trade, ZIP-streaming class); both
  multistatus and ICS byte-identical to the buffered output. Rejected
  shapes kept in the doc: per-page GROUP-BY keyset (3-4x wall) and
  per-uid ANY hydration (~20 µs/index descent).
- SPA listing interning gaps: folder/recent/favorites resources handlers
  (and the WebDAV pseudo-root) called raw Arc::from per row for the
  closed display set ROUND3 interned — now intern_display/intern_mime,
  4→0 allocs/row, byte-identical Arc contents.
- NC PROPFIND child hrefs: username + parent path encoded once per
  request instead of per child (543→165 ns/row, 13→4 allocs); native
  WebDAV href drops its intermediate encode String.
- suggest enrichment: entity clone + field re-clones per keystroke row →
  consume + move (166.5→126.8 µs/200 rows, 20→7 allocs/row).
- list_readable_by returns the cache's Arc (246→128 ns warm hit, 4→0
  allocs) — deep Vec clone per DAV-selector request removed.
- CardDAV REPORT: borrowed props, reused href buffer, exact-size etag
  quoting (3.04→2.34 ms per 5k-contact getetag poll).
- Auth span records: user_id.to_string() per request ×3 →
  tracing::field::display.

Checks: cargo fmt, clippy --all-features --all-targets -D warnings,
cargo test --workspace (523 passed). Follow-ups (CardDAV streaming,
&[&str] id batches, ::text UUID casts A/B, share-landing join) recorded
in benches/ROUND5.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017aJu9ghvuT8WqC31ZEGTBA

src/infrastructure/repositories/pg/drive_pg_repository.rs

@@ -621,13 +621,14 @@ impl DriveRepository for DrivePgRepository {
     async fn list_readable_by(
         &self,
         caller_id: Uuid,
-    ) -> Result<Vec<DriveWithRootName>, DriveRepositoryError> {
+    ) -> Result<Arc<Vec<DriveWithRootName>>, DriveRepositoryError> {
         // Serve from the per-user cache; concurrent misses for the same
         // caller are coalesced into one join (`try_get_with`), and errors
         // are never cached. See the `readable_cache` field docs for the
-        // freshness/invalidation contract.
-        let cached = self
-            .readable_cache
+        // freshness/invalidation contract. The Arc is handed to callers
+        // directly — a warm hit is a refcount bump, not a deep clone of
+        // every row's Strings.
+        self.readable_cache
             .try_get_with(caller_id, async move {
                 self.query_readable_by(caller_id).await.map(Arc::new)
             })
@@ -635,8 +636,7 @@ impl DriveRepository for DrivePgRepository {
             .map_err(|e: Arc<DriveRepositoryError>| {
                 Arc::try_unwrap(e)
                     .unwrap_or_else(|shared| DriveRepositoryError::StorageError(shared.to_string()))
-            })?;
-        Ok((*cached).clone())
+            })
     }
 
     async fn list_all(&self) -> Result<Vec<DriveWithRootName>, DriveRepositoryError> {