perf: Arc<AppState>, streaming PROPFIND, spawn_blocking SHA-256

- Issue #4: Wrap AppState in Arc — eliminates 42 Arc::clone + 16 String::clone per request
- Issue #2: Reject Depth:infinity with 403 + streaming XML with paginated DB queries
- Issue #5: Move chunked upload assembly (SHA-256 hash-on-write) to spawn_blocking
- Remove ~270 lines dead code from di.rs (unused builders, Default impl, stubs)
- Clean up unused tokio imports in chunked_upload_service.rs

src/interfaces/api/handlers/dedup_handler.rs

@@ -9,9 +9,10 @@ use serde::Serialize;
 
 use crate::application::ports::dedup_ports::DedupResultDto;
 use crate::common::di::AppState;
+use std::sync::Arc;
 
 /// Global application state for dependency injection
-type GlobalState = AppState;
+type GlobalState = Arc<AppState>;
 
 /// Response for hash check endpoint
 #[derive(Debug, Serialize)]