Fix memory Leak: use route template for request-metric path label

[shawnburke]

Problem

A heap profile (heap1.prof) showed ~820 MB of ~977 MB retained by Prometheus, attributed to two lines in the request middleware:

561 MB  h.requestLatency.WithLabelValues(r.Method, r.URL.Path, status).Observe(...)
259 MB  h.requestCounter.WithLabelValues(r.Method, r.URL.Path, status).Inc()

The root cause is label-cardinality explosion, not a lack of scraping. prometheus/client_golang keeps every metric series in memory in the registry permanently, regardless of whether anything scrapes /metrics — scraping only reads values, it never frees series.

The path label was set to the raw r.URL.Path. The webhook server registers with mux.PathPrefix("/webhook/"), so every /webhook/<id>/... URL matched and created its own permanent counter and histogram (each histogram is ~11 buckets + sum + count + label pairs, hence the large newHistogram / MakeLabelPairs allocations). Unique webhook ids / resource ids → unbounded series growth → the observed ~1 GB.

Fix

Use the matched mux route template for the path label instead of the raw path:

• /webhook/<any-id> → /webhook/ (PathPrefix route)
• /webhook/{id} variable routes → /webhook/{id}

All concrete URLs collapse to a single bounded series. Falls back to a fixed "<unmatched>" sentinel if no route template is resolvable, so the label can never become unbounded. (Note: mux only runs middleware for matched routes, so 404 scans already never created series.)

This bounds memory for every deployment, not just those that disable metrics.

Tests

Added http_server_metrics_test.go:

• TestRequestMetricsCollapsePrefixRouteToTemplate — 25 distinct /webhook/<id> requests through a PathPrefix route produce exactly one series labeled /webhook/ on both the counter and the histogram. (Fails before the fix with 25 distinct series.)
• TestRequestMetricsCollapseVariableRouteToTemplate — same for a /webhook/{id} variable route, collapsing to /webhook/{id}.

Full ./server/http/ package passes; go build ./... and go vet clean.

🤖 Generated with Claude Code