First part of #2674; also what #2675 measures with.
Done:
[ ] the security floor in src/server.ts adds Server-Timing: app;dur=<ms> (and db time where the handler knows it) to every response
[ ] each request's duration is added to a per-route (the route pattern, never the raw path) histogram in bun:sqlite under FORGE_APP_DATA, bucketed per hour, pruned after 30 days
[ ] the cost is under 0.2 ms per request (a bench in bench/)
[ ] tests: a response has the header; two requests to /alice/x and /bob/y land in one route bucket
Files: src/server.ts, a new module (name it apart from src/kernel/vitals.ts, which is the forge's health), a migration. Risk: an unrelated flaky test in the check (pulls #2688 and #2702 for #2674 died on those) — name it in the pull rather than chase it.
First part of #2674; also what #2675 measures with.
Done:
Server-Timing: app;dur=<ms>(and db time where the handler knows it) to every responseFiles: src/server.ts, a new module (name it apart from src/kernel/vitals.ts, which is the forge's health), a migration. Risk: an unrelated flaky test in the check (pulls #2688 and #2702 for #2674 died on those) — name it in the pull rather than chase it.