fix: critical bugs from deep audit

- Fix copy_files() data loss: implement real copy_file across full stack
  (FileWritePort, FileManagementUseCase, stubs, service, repository with
  atomic CTE + dedup ref_count increment, batch_operations caller)
- Fix plaintext password in replace_default_admin: hash password via
  PasswordHasherPort before User::new()
- Fix CalendarService hardcoded user_id: unify CalendarUseCase trait with
  explicit user_id parameter on all methods, remove zombie _for_user
  duplicates and hardcoded 'current_user_id', update 20 CalDAV handler
  call sites
- Previous session: migrate DedupService to PostgreSQL (storage.blobs),
  atomic CTEs with compensation for file/folder repository operations

src/application/services/batch_operations.rs

@@ -129,7 +129,7 @@ impl BatchOperationService {
                 // Acquire semaphore permit
                 let permit = semaphore.acquire().await.unwrap();
 
-                let copy_result = mgmt.move_file(&file_id, target_folder.clone()).await;
+                let copy_result = mgmt.copy_file(&file_id, target_folder.clone()).await;
 
                 // Release the permit explicitly (also released on drop)
                 drop(permit);