obs: http metrics histogram, client ip and error body logging

[gandalf-at-lerian]

Contexto

Itens de risco médio/alto separados do PR #23 para revisão independente.

Itens nesta PR (draft)

http_client_ip (X-Forwarded-For com trust chain)

Adiciona o campo estruturado http_client_ip ao access log usando c.IP(). O Fiber só resolve X-Forwarded-For quando EnableTrustedProxyCheck + ProxyHeader estão configurados, respeitando a trust chain de proxy — evita spoofing por peers não confiáveis. Parsear o header manualmente reintroduziria essa vulnerabilidade, então delegamos ao mecanismo já auditado do Fiber.

http_error (body do erro com sanitização)

Loga o body da resposta quando status >= 400, no campo http_error. O body passa pelo mesmo pipeline de redação por content-type usado nos request bodies (campos sensíveis viram [OBFUSCATED]) e é truncado em 2 KiB num boundary UTF-8. Respostas não-JSON viram [REDACTED].

http.server.request.duration (histograma OTEL)

Já presente em develop (middleware/telemetry.go): instrumento Float64Histogram registrado no meter, com buckets seguindo o advisory das HTTP semantic conventions, gravado via recordHTTPServerDuration. Nenhuma mudança necessária — incluído aqui apenas para rastreabilidade do escopo solicitado.

Verificação

• go build ./... OK
• go test -tags unit ./... OK (inclui novos testes de client IP, error body sanitizado e omissão em 2xx)
• golangci-lint run ./middleware/ 0 issues

Requested-by: @qnen

[lerian-studio]

📊 Unit Test Coverage Report: lib-observability

Metric	Value
Overall Coverage	85.5% ✅ PASS
Threshold	80%

Coverage by Package

Package	Coverage
github.com/LerianStudio/lib-observability/assert	97.9%
github.com/LerianStudio/lib-observability/constants	83.3%
github.com/LerianStudio/lib-observability/log	94.9%
github.com/LerianStudio/lib-observability/metrics	91.4%
github.com/LerianStudio/lib-observability/middleware	76.5%
github.com/LerianStudio/lib-observability/redaction	95.8%
github.com/LerianStudio/lib-observability/runtime	80.4%
github.com/LerianStudio/lib-observability/tracing	85.1%
github.com/LerianStudio/lib-observability/zap	96.0%
github.com/LerianStudio/lib-observability	91.5%

---

Generated by Go PR Analysis workflow

[lerian-studio]

🔒 Security Scan Results — lib-observability

✅ PR Mergeable — no blocking findings

Stage	Status	Blocking?
Filesystem Scan	✅ Clean	—
Docker Image Scan	➖ Skipped	—
Docker Hub Health Score	➖ Skipped	—
Pre-release Version Check	✅ Clean	—

Trivy

Filesystem Scan

✅ No vulnerabilities or secrets found.

---

Pre-release Version Check

✅ No unstable version pins found.

---

_{🔍 View full scan logs}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2d49ef06-2b6f-48ba-a4a1-00b1148488d8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}