feat(profiling): continuous CPU/heap profiling via WithProfiling

[FrameAutomata]

What

Adds opt-in continuous profiling to the core SDK. traceway.WithProfiling(serviceName) starts a background goroutine that, on an interval (WithProfilingInterval, default 60s; CPU window ~30s, capped to interval/2), captures a CPU profile and a heap profile and POSTs each as a separate request to <server>/api/profiles/ingest.

Also folds in a small, independent hardening commit: Init no longer panics on a malformed connection string.

Why

Profiling powers flame graphs / allocation views alongside the existing traces and metrics. The ingest contract is already live on the backend.

How it works

• Reuses the existing report plumbing. The ingest URL is derived from the connection-string report URL (scheme://host + /api/profiles/ingest); auth (Authorization: Bearer <token>), serverName, and appVersion come from the same config as /api/report.
• No double compression. The body is the raw, already-gzipped pprof bytes with no extra Content-Encoding — the backend's gzip middleware only decompresses when that header is present, and profile.Parse reads gzipped pprof directly.
• Verified against the backend contract: path, Bearer auth, service/serverName/appVersion query params, raw pprof body, and 200 {} success.
• Never affects the host app. Capture/upload failures are isolated per profile and silent unless WithDebug(true) is set; a bad URL disables profiling without failing Init.

Scope

Core traceway package only. HTTP middleware pass-through options (tracewayhttp/gin/fiber/chi/fasthttp) are a deliberate follow-up — apps that call traceway.Init directly (e.g. workers using MeasureTask) can enable it today.

Commits

• feat(profiling): add WithProfiling continuous CPU/heap profiling
• fix(init): reject malformed connection strings instead of panicking

Tests

• URL derivation; CPU/heap capture (validated by full gzip decompression, not just magic bytes); upload request shape (path / Bearer / query params / byte-exact raw body / no gzip Content-Encoding); options wiring; and a deterministic single-cycle test asserting CPU + heap are sent as two requests.
• Regression test for the Init panic fix.
• go test, go vet, go build all green; framework subpackage suites (tracewayhttp, tracewaygin) green.

Docs

See docs/profiling.md.

🤖 Generated with Claude Code