perf: findings 6.1, 6.2, 2.6 — async Argon2, moka cache, full streaming migration

- 6.1: PasswordHasherPort now async_trait with spawn_blocking for Argon2
- 6.2: OIDC pending maps migrated from std::sync::Mutex to moka::sync::Cache with TTL
- 2.6: All file download paths migrated to 64KB streaming (get_file_stream / read_blob_stream)
  - WOPI, dedup, batch ZIP, file_retrieval_service consumers migrated
  - WebDAV COPY uses zero-copy dedup (copy_file)
  - Removed dead code: get_file_content, get_file_mmap, read_blob, read_blob_bytes
    from traits, impls, stubs, and mocks (18 files touched)

src/application/ports/auth_ports.rs

@@ -11,12 +11,16 @@ use async_trait::async_trait;
 ///
 /// This trait abstracts cryptographic password operations, allowing the domain
 /// layer to remain independent of specific hashing implementations (argon2, bcrypt, etc.)
+///
+/// Methods are async because implementations (e.g. Argon2) are CPU-intensive
+/// and must run on a blocking thread pool to avoid starving Tokio workers.
+#[async_trait]
 pub trait PasswordHasherPort: Send + Sync + 'static {
     /// Hash a plain text password
-    fn hash_password(&self, password: &str) -> Result<String, DomainError>;
+    async fn hash_password(&self, password: &str) -> Result<String, DomainError>;
 
     /// Verify a plain text password against a hash
-    fn verify_password(&self, password: &str, hash: &str) -> Result<bool, DomainError>;
+    async fn verify_password(&self, password: &str, hash: &str) -> Result<bool, DomainError>;
 }
 
 /// Claims contained in a JWT token