fix: eliminate Prometheus Counter anti-patterns and security issues

[Copilot]

Addresses code review feedback from PR #26: improper Counter manipulation, missing type annotations, fragile parsing, and XSS vulnerability.

Changes

Prometheus Counter tracking (prometheus_exporter.py)

• Replaced _value attribute access with internal state tracking
• Added _last_request_total, _last_cost_total, _last_savings_total dictionaries
• Counters now properly increment via .inc() with calculated deltas

# Before: accessing private implementation details
counter = self.request_total.labels(...)
current_value = getattr(counter, '_value', None)
if current_value is not None:
    increment = total - current_value.get()

# After: track state internally
key = (name, "success")
last_total = self._last_request_total.get(key, 0.0)
increment = current_total - last_total
if increment > 0:
    self.request_total.labels(...).inc(increment)
    self._last_request_total[key] = current_total

Type annotations (recorder.py)

• Added proper types to __aexit__: type[BaseException] | None, BaseException | None, TracebackType | None
• Removed # type: ignore[no-untyped-def] suppression

PAF parsing (paf_memory.py)

• Replaced string split with regex: r"- \*\*([A-Z]+-\d+)\*\*:\s*(.+)"
• Handles formatting variations and edge cases correctly

XSS prevention (test_runner.py)

• Added html.escape() to test case names and statuses in HTML report generation
• Prevents injection of malicious content in test reports

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull Request Overview

This PR addresses code quality issues identified in review feedback, focusing on eliminating Prometheus Counter anti-patterns, improving type safety, enhancing parsing robustness, and preventing XSS vulnerabilities.

Key changes:

• Replaced improper Prometheus Counter _value access with internal state tracking
• Added proper type annotations to async context manager methods
• Improved PAF parsing from string splitting to regex-based parsing
• Added HTML escaping to prevent XSS in test report generation

Reviewed Changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

File	Description
prometheus_exporter.py	Eliminated Counter anti-pattern by tracking last values internally instead of accessing private _value attribute
recorder.py	Added proper type hints to __aexit__ parameters, removing type checking suppression
paf_memory.py	Replaced fragile string split parsing with regex for more robust PAF entry extraction
test_runner.py	Added html.escape() to prevent XSS injection in HTML test reports