Fix CalDAV/CardDAV multiget loading entire collections into memory

A REPORT multiget for a handful of resources previously listed the
whole calendar/address book (every row incl. ical_data/vcard) and
filtered by href in Rust with an O(N×M) substring scan. Large
collections paid full-table latency, RAM and DB CPU on every sync.

- Add find_events_by_ical_uids / get_contacts_by_uids through every
  layer (domain repo trait → PG repo → storage port/adapter → use case
  → handler) using one indexed `= ANY($2)` query, mirroring the
  existing single-UID lookups.
- Extract UIDs from multiget hrefs with a shared, tested
  uid_from_multiget_href helper (percent-decoding, case-insensitive
  extension strip, collection hrefs rejected). Exact UID matching also
  removes the false positives the old substring filter allowed.
- CalDAV PROPFIND single-event path now uses the existing indexed
  get_event_by_ical_uid instead of listing all events.
- Honour the already-documented limit/offset query params on
  GET /api/address-books/{id}/contacts: optional ListQuery fields
  thread through ContactUseCase::list_contacts to a paginated repo
  query. Omitted params keep returning the full book (frontend and
  DAV listing/sync paths unchanged).

https://claude.ai/code/session_0193Hff42gaA962wThxMGSd1

src/application/services/calendar_service.rs

@@ -300,6 +300,32 @@ impl CalendarUseCase for CalendarService {
             .await
     }
 
+    async fn get_events_by_ical_uids(
+        &self,
+        calendar_id: &str,
+        ical_uids: &[String],
+        user_id: Uuid,
+    ) -> Result<Vec<CalendarEventDto>, DomainError> {
+        let has_access = self
+            .calendar_storage
+            .check_calendar_access(calendar_id, user_id)
+            .await?;
+        let calendar = self.calendar_storage.get_calendar(calendar_id).await?;
+        if !has_access && !calendar.is_public {
+            return Err(DomainError::new(
+                ErrorKind::AccessDenied,
+                "Calendar",
+                "You don't have permission to view events in this calendar",
+            ));
+        }
+        if ical_uids.is_empty() {
+            return Ok(Vec::new());
+        }
+        self.calendar_storage
+            .find_events_by_ical_uids(calendar_id, ical_uids)
+            .await
+    }
+
     async fn list_events(
         &self,
         calendar_id: &str,

src/application/services/contact_service.rs

@@ -796,9 +796,34 @@ impl ContactUseCase for ContactService {
         Ok(contact.map(ContactDto::from))
     }
 
+    async fn get_contacts_by_uids(
+        &self,
+        address_book_id: &str,
+        uids: &[String],
+        user_id: Uuid,
+    ) -> Result<Vec<ContactDto>, DomainError> {
+        let id = Uuid::parse_str(address_book_id)
+            .map_err(|_| DomainError::validation_error("Invalid address book ID format"))?;
+
+        // Check if user has access to the address book
+        self.check_address_book_access(&id, &user_id).await?;
+
+        if uids.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        let contacts = self
+            .contact_repository
+            .get_contacts_by_uids(&id, uids)
+            .await?;
+        Ok(contacts.into_iter().map(ContactDto::from).collect())
+    }
+
     async fn list_contacts(
         &self,
         address_book_id: &str,
+        limit: Option<i64>,
+        offset: Option<i64>,
         user_id: Uuid,
     ) -> Result<Vec<ContactDto>, DomainError> {
         let id = Uuid::parse_str(address_book_id)
@@ -808,10 +833,17 @@ impl ContactUseCase for ContactService {
         self.check_address_book_access(&id, &user_id).await?;
 
         // Get contacts
-        let contacts = self
-            .contact_repository
-            .get_contacts_by_address_book(&id)
-            .await?;
+        let contacts = if limit.is_some() || offset.is_some() {
+            let limit = limit.unwrap_or(100);
+            let offset = offset.unwrap_or(0);
+            self.contact_repository
+                .get_contacts_by_address_book_paginated(&id, limit, offset)
+                .await?
+        } else {
+            self.contact_repository
+                .get_contacts_by_address_book(&id)
+                .await?
+        };
         let dtos = contacts.into_iter().map(ContactDto::from).collect();
 
         Ok(dtos)
@@ -1324,7 +1356,9 @@ impl StorageUseCase for ContactService {
                 let user_id = Uuid::parse_str(user_id)
                     .map_err(|_| DomainError::validation_error("Invalid user_id format"))?;
 
-                let result = self.list_contacts(address_book_id, user_id).await?;
+                let result = self
+                    .list_contacts(address_book_id, None, None, user_id)
+                    .await?;
                 Ok(serde_json::to_value(result).unwrap())
             }
             "search_contacts" => {