[TD-07] 1728 `.clone()` call sites — likely cascade in client/web

[intendednull]

Audit finding from #300 (commit 679f9fe)

Severity: medium
Category: tech debt / performance
File: top offenders: crates/web/tests/browser.rs (172), crates/client/src/lib.rs (165), crates/web/src/components/message.rs (104), crates/web/src/app.rs (89), crates/client/src/listeners.rs (55), crates/client/src/mutations.rs (51), crates/client/src/views.rs (45)
Obvious fix: no

Description

1728 .clone() invocations. Even discounting the 172 in browser tests, hot rendering paths (web/components/message.rs at 104) and client orchestration (lib.rs at 165) suggest a pattern of cloning structs into closures rather than passing references or Arc-wrapping shared state.

Impact / Threat

Maintenance, performance — defensive cloning hides ownership intent.

Suggested fix

Audit client/src/lib.rs and client/src/listeners.rs for Arc-able shared state; for Leptos signals confirm whether with / read would avoid the clone.

Verify

rg "\.clone\(\)" --type rust crates/ -c | sort -t: -k2 -nr | head
rg "\.clone\(\)" --type rust crates/ | wc -l