feat: add bounded process metrics and private monitoring endpoint

internal/config/config_test.go

@@ -0,0 +1,25 @@
+package config
+
+import "testing"
+
+func TestMetricsAddressIsExplicitAndValidated(t *testing.T) {
+	base := map[string]string{"ORBIT_MYSQL_DSN": "private-dsn"}
+	get := func(k string) string { return base[k] }
+	c, err := FromEnv(get)
+	if err != nil || c.MetricsAddr != "" {
+		t.Fatal("metrics must be disabled by default", err)
+	}
+	for _, addr := range []string{"127.0.0.1:0", "[::1]:9090", "0.0.0.0:9090"} {
+		base["ORBIT_METRICS_ADDR"] = addr
+		c, err = FromEnv(get)
+		if err != nil || c.MetricsAddr != addr {
+			t.Fatal("valid explicit address rejected", addr, err)
+		}
+	}
+	for _, addr := range []string{"bad", ":secret", "127.0.0.1:-1", ":65536", "http://127.0.0.1:9000"} {
+		base["ORBIT_METRICS_ADDR"] = addr
+		if _, err = FromEnv(get); err == nil {
+			t.Fatal("invalid address accepted", addr)
+		}
+	}
+}