fix: bound admin panel metrics labels

[danny-avila]

Summary

I bounded admin panel HTTP metrics labels so Prometheus cannot retain one series per arbitrary request path, reducing the risk of request-driven memory growth after the OOMKilled incident.

• Added normalizeMetricsPath to collapse app routes, static assets, TanStack server functions, and unknown paths into a fixed set of labels.
• Wrapped both static-route and app-route responses with shared HTTP metrics recording so request counters and histograms use the normalized path label.
• Added coverage for known routes, static assets, server-function paths, and arbitrary unknown paths.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

• Ran bun run test src/server/metrics.test.ts.
• Ran bun run lint.
• Ran SESSION_SECRET=dev-only-session-secret-minimum-32-chars! bun run test.
• Ran bun run build.
• Smoke-tested the built Bun server and verified /metrics emitted bounded labels for static_asset, server_function, and unknown.

Test Configuration:

• Bun 1.3.13
• Vitest 3.2.4
• Vite 8.0.3

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes

[danny-avila]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".