Tracing: DAO layer + handler spans on tracing, drop all Context params (#141)

trace_db_call no longer takes an OpenTelemetry Context: it opens a
db.<query_type>.<operation> span (same name via otel.name, same
db.query_type / db.operation attrs) on the caller's ambient tracing span
and runs the DAO body inside it. The cx / ctx / context parameter is gone
from every DAO trait method, impl and call site, and from the helpers and
background drains that only threaded it.

The remaining request-handler spans (files, tags, faces, image, video,
favorites, duplicates, memories) move to #[instrument]; the
Context::current_with_span / with_remote_span_context plumbing is gone, as
is extract_context_from_request (the tracing-actix-web root span covers
it). otel::set_span_attributes replaces BoxedSpan::set_attributes.

Background-job raw spans (thumbnails, video actors) are left for #142.

tests/otel_db_spans.rs pins name, attributes, status and nesting (across
an instrumented spawn); otel_traceparent now uses an #[instrument]
handler. CLAUDE.md documents the tracing conventions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/personas.rs

@@ -150,9 +150,8 @@ async fn list_personas(claims: Claims, dao: PersonaDaoData) -> impl Responder {
     let Some(uid) = user_id_from_claims(&claims) else {
         return HttpResponse::Unauthorized().json(serde_json::json!({"error": "Invalid claims"}));
     };
-    let cx = opentelemetry::Context::current();
     let mut dao = dao.lock().expect("Unable to lock PersonaDao");
-    match dao.list_personas(&cx, uid) {
+    match dao.list_personas(uid) {
         Ok(rows) => {
             let views: Vec<PersonaView> = rows.into_iter().map(PersonaView::from).collect();
             HttpResponse::Ok().json(views)
@@ -181,7 +180,6 @@ async fn create_persona(
             .json(serde_json::json!({"error": "systemPrompt is required"}));
     }
 
-    let cx = opentelemetry::Context::current();
     let mut dao = dao.lock().expect("Unable to lock PersonaDao");
 
     let pid = match body.persona_id.as_deref() {
@@ -197,20 +195,12 @@ async fn create_persona(
     // Pre-check existence so we can return 409 cleanly. The DB UNIQUE
     // would also catch it, but parsing Diesel's "constraint violation"
     // out of a generic DbError is uglier than a quick lookup.
-    if let Ok(Some(_)) = dao.get_persona(&cx, uid, &pid) {
+    if let Ok(Some(_)) = dao.get_persona(uid, &pid) {
         return HttpResponse::Conflict()
             .json(serde_json::json!({"error": "persona already exists"}));
     }
 
-    match dao.create_persona(
-        &cx,
-        uid,
-        &pid,
-        &body.name,
-        &body.system_prompt,
-        false,
-        false,
-    ) {
+    match dao.create_persona(uid, &pid, &body.name, &body.system_prompt, false, false) {
         Ok(p) => HttpResponse::Created().json(PersonaView::from(p)),
         Err(e) => {
             log::error!("create_persona error: {:?}", e);
@@ -229,7 +219,6 @@ async fn update_persona(
         return HttpResponse::Unauthorized().json(serde_json::json!({"error": "Invalid claims"}));
     };
     let pid = path.into_inner();
-    let cx = opentelemetry::Context::current();
     let mut dao = dao.lock().expect("Unable to lock PersonaDao");
 
     // Built-in personas are owned by the migration; the canonical voice
@@ -239,7 +228,7 @@ async fn update_persona(
     // from the picker. `include_all_memories` stays editable on
     // built-ins — that's a per-user preference, not the persona's
     // identity. Mirrors the same guard delete_persona enforces below.
-    match dao.get_persona(&cx, uid, &pid) {
+    match dao.get_persona(uid, &pid) {
         Ok(Some(p)) if p.is_built_in => {
             let editing_identity = body.name.is_some() || body.system_prompt.is_some();
             if editing_identity {
@@ -267,7 +256,7 @@ async fn update_persona(
         reviewed_only_facts: body.reviewed_only_facts,
         allow_agent_corrections: body.allow_agent_corrections,
     };
-    match dao.update_persona(&cx, uid, &pid, patch) {
+    match dao.update_persona(uid, &pid, patch) {
         Ok(Some(p)) => HttpResponse::Ok().json(PersonaView::from(p)),
         Ok(None) => {
             HttpResponse::NotFound().json(serde_json::json!({"error": "Persona not found"}))
@@ -288,10 +277,9 @@ async fn delete_persona(
         return HttpResponse::Unauthorized().json(serde_json::json!({"error": "Invalid claims"}));
     };
     let pid = path.into_inner();
-    let cx = opentelemetry::Context::current();
     let mut dao = dao.lock().expect("Unable to lock PersonaDao");
 
-    match dao.get_persona(&cx, uid, &pid) {
+    match dao.get_persona(uid, &pid) {
         Ok(Some(p)) if p.is_built_in => {
             return HttpResponse::Conflict()
                 .json(serde_json::json!({"error": "Cannot delete built-in persona"}));
@@ -308,7 +296,7 @@ async fn delete_persona(
         Ok(Some(_)) => {}
     }
 
-    match dao.delete_persona(&cx, uid, &pid) {
+    match dao.delete_persona(uid, &pid) {
         Ok(_) => HttpResponse::NoContent().finish(),
         Err(e) => {
             log::error!("delete_persona error: {:?}", e);
@@ -325,7 +313,6 @@ async fn migrate_personas(
     let Some(uid) = user_id_from_claims(&claims) else {
         return HttpResponse::Unauthorized().json(serde_json::json!({"error": "Invalid claims"}));
     };
-    let cx = opentelemetry::Context::current();
     let mut dao = dao.lock().expect("Unable to lock PersonaDao");
 
     // Filter out built-in ids — those are already seeded by the
@@ -345,7 +332,7 @@ async fn migrate_personas(
         })
         .collect();
 
-    match dao.bulk_import(&cx, uid, &rows) {
+    match dao.bulk_import(uid, &rows) {
         Ok(inserted) => HttpResponse::Ok().json(MigrateResponse { inserted }),
         Err(e) => {
             log::error!("migrate_personas error: {:?}", e);