Add CodSpeed performance benchmarks

[codspeed-hq]

Summary

This PR sets up continuous performance tracking with CodSpeed for the capgo backend. It adds a benchmark suite targeting core utility functions that are called on hot paths (device updates, password validation, analytics queries) and a GitHub Actions workflow to run them automatically.

What changed

• Benchmark files (benches/): Three benchmark files covering password policy validation, device comparison/normalization, and analytics limit normalization -- all pure functions with no external service dependencies.
• Vitest benchmark config (vitest.config.bench.ts): Dedicated Vitest configuration with the @codspeed/vitest-plugin for instrumented measurements.
• GitHub Actions workflow (.github/workflows/codspeed.yml): Runs benchmarks on pushes to main, on pull requests, and on manual dispatch (for CodSpeed backtesting). Uses OIDC authentication and simulation mode.
• @codspeed/vitest-plugin added as a dev dependency with lockfile updated.
• CodSpeed badge added to README alongside existing project badges.

Benchmarked functions

File	Functions	Why
password_policy.ts	getPasswordUtf8ByteLength, getEffectivePasswordMinLength, getPasswordPolicyValidationErrors	Called on every signup/password change; regex + UTF-8 encoding
deviceComparison.ts	toComparableDevice, toComparableExisting, hasComparableDeviceChanged, buildNormalizedDeviceForWrite	Called on every device update; object normalization and field-by-field diff
cloudflare.ts	normalizeAnalyticsLimit	Called on every analytics query; numeric validation and boundary clamping

Next steps

• After merging, CodSpeed will run a backtest to establish baseline measurements on the main branch.
• Future PRs will automatically get performance change reports in PR comments.
• Additional benchmarks can be added to benches/ following the same pattern.

Test plan

• Benchmarks pass locally with npx vitest bench --config vitest.config.bench.ts --run
• Benchmarks validated with codspeed run --mode simulation (all 28 benchmarks measured)
• TypeScript typecheck passes (vue-tsc --noEmit)
• No changes to existing tests or source code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​codspeed/​vitest-plugin@​5.2.0

View full report

[codspeed-hq]

Congrats! CodSpeed is installed 🎉

🆕 28 new benchmarks were detected.

You will start to see performance impacts in the reports once the benchmarks are run from your default branch.

Detected benchmarks

• negative number: 15.2 µs
• valid password against strict policy: 41.5 µs
• NaN and Infinity: 17.7 µs
• invalid password (all rules fail): 38.5 µs
• multibyte password validation: 30 µs
• valid number within range: 25.4 µs
• float truncation: 14.9 µs
• full existing row: 40 µs
• long ASCII password (72 bytes): 29.7 µs
• null/undefined existing: 16 µs
• sparse existing row: 16.5 µs
• non-number types: 14.2 µs
• ASCII password: 40.6 µs
• number exceeding max: 15.8 µs
• full device object: 42.2 µs
• zero: 15.2 µs
• full device: 71 µs
• with custom fallback: 12.2 µs
• sparse device with defaults: 15.6 µs
• with undefined: 14.3 µs
• ...

ℹ️ Only the first 20 benchmarks are displayed. Go to the app to view all benchmarks.

---

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud