feat: add bounded process metrics and private monitoring endpoint

internal/transport/httpserver/server_test.go

@@ -7,6 +7,8 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+
+	"git.yuntuo.hk/k2safe/orbit/internal/observability"
 )
 
 func TestHealthSeparatesLivenessAndReadiness(t *testing.T) {
@@ -19,3 +21,28 @@ func TestHealthSeparatesLivenessAndReadiness(t *testing.T) {
 		}
 	}
 }
+
+func TestMetricsListenerIsSeparateAndOptional(t *testing.T) {
+	metrics := observability.NewRegistry()
+	business := New("", nil)
+	WrapMetrics(business, metrics)
+	private := NewMetricsServer("", metrics)
+	for _, tc := range []struct {
+		handler http.Handler
+		path    string
+		want    int
+	}{
+		{business.Handler, "/metrics", 404}, {private.Handler, "/v1/tasks", 404},
+		{private.Handler, "/metrics", 200}, {NewMetricsServer("", nil).Handler, "/metrics", 404},
+		{private.Handler, "/metrics?secret=value", 400},
+	} {
+		rr := httptest.NewRecorder()
+		tc.handler.ServeHTTP(rr, httptest.NewRequest("GET", tc.path, nil))
+		if rr.Code != tc.want {
+			t.Fatalf("%s: %d", tc.path, rr.Code)
+		}
+		if strings.Contains(rr.Body.String(), "secret") {
+			t.Fatal("query leaked")
+		}
+	}
+}