perf(round29): cache-serve borrow-probe, NC REPORT href buffer, auth per-req allocs, DB over-fetch

Seven behaviour-preserving allocation / copy / bandwidth cuts, each behind a
counting-allocator BEFORE/AFTER gate that exit(1)s unless AFTER allocates
strictly fewer than BEFORE (benches/ROUND29.md, examples/bench_round29_micro.rs).

- [B] Content-cache serve fast path (optimized_inner Tier 1 +
  get_file_range_preloaded — the video-scrub hot path): probe the cache with a
  borrow first and build the owned get_or_load args (quoted-etag / key / id
  Strings) only on a miss, instead of allocating them before every probe and
  discarding them on a hit. 6 -> 0 allocs per cache hit. Splits get_or_load into
  get + load_and_cache so the miss path is not re-probed and the hit/miss stat
  counters stay byte-identical. Also drops the unconditional content_hash/name
  clones that ran for the >=10 MB streaming tier that used neither.
- [A] NextCloud REPORT emit loops: per-row href String (and format! per folder
  row) -> one reused href_buf via nc_href_into / nc_collection_href_into with the
  URL-encoded user computed once per page. 1497 fewer allocs on a 500-row page.
- [C] read_full: a single-frame blob is returned zero-copy instead of a second
  whole-payload memcpy into a fresh BytesMut; multi-frame path unchanged.
- [D] login-lockout key: to_lowercase()+format! -> one pre-sized ASCII buffer
  (non-ASCII keeps str::to_lowercase). 3 -> 1 alloc/req, byte-identical key.
- [E] NC composite-username parse: owned clone/to_string -> &str borrow of the
  already-owned raw_username. 1 -> 0 alloc on the common no-marker path.
- [F] get_contacts_in_group: stop SELECTing the discarded multi-KB vcard column
  (the live method ROUND25 §Q2 missed; ContactDto has no vcard field).
- [G] count_admin_users: add count_users_by_role -> scalar COUNT(*) instead of
  hydrating every admin's full row (incl. up-to-512 KiB avatar + ui_preferences
  JSONB) only to .len() it, on a bootstrap-polled status endpoint.

All seven gates pass; cargo fmt --check and cargo clippy --all-features
--all-targets -D warnings clean. §F/§G additionally validated against a live
PostgreSQL 16 with the full migration set (query validity, result equivalence,
600000 -> 8 byte wire delta on the admin count).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhpDZxSQTAGnAqCHUdtG5N

src/infrastructure/services/file_content_cache.rs

@@ -182,7 +182,30 @@ impl FileContentCache {
         if let Some(hit) = self.get(&cache_key).await {
             return Ok(hit);
         }
+        self.load_and_cache(cache_key, etag, content_type, load)
+            .await
+    }
 
+    /// The populate-on-miss half of [`Self::get_or_load`], with single-flight
+    /// coalescing but WITHOUT the leading `get` probe.
+    ///
+    /// Hot read paths that have *already* probed the cache with [`Self::get`]
+    /// (a borrow) call this directly on the miss branch — they then build the
+    /// owned `cache_key` / `etag` / `content_type` (each a heap allocation)
+    /// only when they are actually needed to populate, so a cache HIT allocates
+    /// none of them (benches/ROUND29.md §B). Because the caller's own `get`
+    /// already counted the hit/miss, this method does not re-probe — keeping the
+    /// hit/miss stat counts identical to a single `get_or_load` call.
+    pub async fn load_and_cache<F>(
+        &self,
+        cache_key: String,
+        etag: Arc<str>,
+        content_type: Arc<str>,
+        load: F,
+    ) -> Result<(Bytes, Arc<str>, Arc<str>), DomainError>
+    where
+        F: Future<Output = Result<Bytes, DomainError>>,
+    {
         // Slow path: coalesce concurrent misses into a single `load`.
         let entry = self
             .cache

src/infrastructure/services/login_lockout_service.rs

@@ -68,7 +68,24 @@ impl LoginLockoutService {
     fn key(username: &str, client_ip: &str) -> String {
         // `|` is not valid in either a username or an IP literal so it makes
         // the username/ip boundary unambiguous.
-        format!("{}|{}", username.to_lowercase(), client_ip)
+        //
+        // The lowercased composite is written into ONE pre-sized buffer instead
+        // of the `to_lowercase()` (alloc) + `format!` (alloc) two-step. App
+        // passwords authenticate with an already-lowercase ASCII username in
+        // ~all traffic, so the fast branch covers it; the rare non-ASCII branch
+        // keeps `str::to_lowercase` for exact Unicode (e.g. final-sigma)
+        // semantics. Byte-identical key either way (benches/ROUND29.md §D).
+        if username.is_ascii() {
+            let mut k = String::with_capacity(username.len() + 1 + client_ip.len());
+            for &b in username.as_bytes() {
+                k.push(b.to_ascii_lowercase() as char);
+            }
+            k.push('|');
+            k.push_str(client_ip);
+            k
+        } else {
+            format!("{}|{}", username.to_lowercase(), client_ip)
+        }
     }
 
     /// Check whether the (account, IP) pair is currently locked.