fix(observability): label HTTP metrics by route pattern, not raw path (#1791)

## Bug

With `observability.metrics.enabled`, `MetricsManager.HTTPMiddleware` is
the first middleware on the REST API chi router (`setupRoutes`), ahead
of `apiKeyAuthMiddleware`. It labels `mcpproxy_http_requests_total` and
`mcpproxy_http_request_duration_seconds` with `r.URL.Path`.

So every distinct path creates a new counter series and a new histogram
series (11 buckets plus sum and count), and they are never removed. That
includes unauthenticated requests that end in 401 or 404, and every
server name in `/api/v1/servers/{name}/…`.

## Trigger

With metrics enabled, any client that can reach the listener sends
requests to distinct paths, for example `GET /api/v1/<random>` in a
loop. A web page open in the user's browser can do this against
`127.0.0.1` with `fetch(..., {mode: "no-cors"})`, and no API key is
needed. The daemon's memory and the size of every `/metrics` scrape then
grow without bound.

## Fix

Label requests with the chi route pattern they matched
(`/api/v1/servers/{name}`). A request that matched no route gets one
fixed `unmatched` label. Outside a chi router, which no production
caller uses, the raw path is kept. The label name (`path`) and the other
labels are unchanged, so the Grafana dashboard, which sums by `status`,
keeps working.

## Test

`TestHTTPMiddleware_PathLabelIsRoutePattern`: a chi router with one
`/api/v1/servers/{name}` route. It receives requests for two server
names and two unknown paths. It must end up with exactly two series: the
route pattern with count 2, and `unmatched` with count 2.

## Commands run

- `CGO_ENABLED=0 go test -count=1 -run 'Test'
./internal/observability/`: ok
- On current `main`, and again with the fix reverted, the new test fails
with `expected: 2, actual: 4` series.
- `go vet ./internal/observability/`: ok

Author: rudycelekli

internal/observability/metrics.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 	"time"
 
+	"github.com/go-chi/chi/v5"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/collectors"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
@@ -431,11 +432,30 @@ func (mm *MetricsManager) HTTPMiddleware() func(http.Handler) http.Handler {
 
 			// Record metrics
 			duration := time.Since(start)
-			mm.RecordHTTPRequest(r.Method, r.URL.Path, http.StatusText(ww.statusCode), duration)
+			mm.RecordHTTPRequest(r.Method, routeLabel(r), http.StatusText(ww.statusCode), duration)
 		})
 	}
 }
 
+// unmatchedRouteLabel is the path label for a request no route matched.
+const unmatchedRouteLabel = "unmatched"
+
+// routeLabel is the path label for r: the chi route pattern it matched
+// ("/api/v1/servers/{name}"), never the raw path. The middleware runs before
+// authentication, so a raw-path label would let any caller add a counter and
+// a histogram series per distinct path it sends. Outside a chi router the raw
+// path is kept.
+func routeLabel(r *http.Request) string {
+	rctx := chi.RouteContext(r.Context())
+	if rctx == nil {
+		return r.URL.Path
+	}
+	if pattern := rctx.RoutePattern(); pattern != "" {
+		return pattern
+	}
+	return unmatchedRouteLabel
+}
+
 // responseWriter wraps http.ResponseWriter to capture status code
 type responseWriter struct {
 	http.ResponseWriter

internal/observability/metrics_test.go

@@ -1,10 +1,13 @@
 package observability
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/go-chi/chi/v5"
 	"github.com/prometheus/client_golang/prometheus/testutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -55,6 +58,26 @@ func TestToolCallMetric_NoPerUserCardinalityLabels(t *testing.T) {
 	assert.NotContains(t, body, "profile=", "tool-call metric must not carry a profile label")
 }
 
+// The HTTP middleware runs before authentication, so its path label must be
+// the matched route, not the raw request path: otherwise every distinct path
+// anyone sends adds a counter and a histogram series that is never freed.
+func TestHTTPMiddleware_PathLabelIsRoutePattern(t *testing.T) {
+	mm := NewMetricsManager(zap.NewNop().Sugar())
+	r := chi.NewRouter()
+	r.Use(mm.HTTPMiddleware())
+	r.Get("/api/v1/servers/{name}", func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+
+	for _, p := range []string{"/api/v1/servers/a", "/api/v1/servers/b", "/api/v1/nope-1", "/api/v1/nope-2"} {
+		r.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, p, nil))
+	}
+
+	assert.Equal(t, 2, testutil.CollectAndCount(mm.httpRequests), "one series per route plus one for unmatched paths")
+	assert.InDelta(t, 2.0, testutil.ToFloat64(mm.httpRequests.WithLabelValues(http.MethodGet, "/api/v1/servers/{name}", "OK")), 1e-9)
+	assert.InDelta(t, 2.0, testutil.ToFloat64(mm.httpRequests.WithLabelValues(http.MethodGet, "unmatched", "Not Found")), 1e-9)
+}
+
 func scrapeMetrics(t *testing.T, mm *MetricsManager) string {
 	t.Helper()
 	families, err := mm.registry.Gather()