Fix profiler overhead, canary baseline rollback, pool leak detection, WebAuthn downgrade protection

[kanengchik]

Summary

Fixes four issues across observability, deployment safety, database reliability, and authentication security:

• Add Profiler Sampling Overhead Guard #384 — Profiler Sampling Overhead Guard: ProfilerState now tracks its own recording overhead as a percentage of profiled operation time. Once overhead exceeds 5%, the sample rate is automatically halved (down to a 1% floor) so continuous profiling can't itself become a bottleneck. Current overhead and sample rate are exposed via GET /admin/profiler/overhead. Documented in docs/profiling-guide.md.

• Implement Canary Deployment Automatic Rollback on Error Spike #385 — Canary Deployment Automatic Rollback on Error Spike: POST /deployments/canary/:id/evaluate now accepts an optional baseline_error_rate on every call, enabling continuous canary-vs-baseline comparison. If the canary's error rate exceeds the reported baseline by more than thresholds.max_error_rate_margin (default 1 percentage point), the deployment is automatically rolled back — independent of the existing absolute max_error_rate/max_latency_p99_ms thresholds. Documented in docs/canary-deployments.md.

• Add Pool Optimizer Connection Leak Detection #386 — Pool Optimizer Connection Leak Detection: OptimizedConnectionPool now tracks a checkout timestamp per connection. Connections held longer than DB_POOL_MAX_CHECKOUT_SECS (default 60s) are flagged as suspected leaks via detect_leaks(), surfaced in PoolMetrics::suspected_leaks, and can be logged + paged to on-call via the new check_for_leaks_and_alert() method, which uses a new oncall::raise_alert() helper. Documented in docs/configuration-reference.md.

• Implement WebAuthn Credential Algorithm Downgrade Protection #387 — WebAuthn Credential Algorithm Downgrade Protection: CoseAlgorithm now has an explicit ALLOWED_ALGORITHMS allowlist and a relative strength ranking (EdDSA > ES256 > RS256). Registration is rejected with 400 if the algorithm isn't allowlisted, and with 409 if a user attempts to register a new credential using a weaker algorithm than one they already have on file (downgrade attack prevention). Documented in docs/webauthn-setup.md.

Each issue's task list called for tests, so unit/integration tests covering the new behavior were added alongside the implementation in each file.

Test plan

• cargo test -p ethos-protocol-backend profiler:: — overhead throttling tests
• cargo test -p ethos-protocol-backend canary:: — baseline rollback trigger/non-trigger tests
• cargo test -p ethos-protocol-backend pool_optimizer:: — leak detection tests
• cargo test -p ethos-protocol-backend webauthn:: — algorithm allowlist/downgrade tests
• cargo test -p ethos-protocol-backend oncall:: — alert-raising tests

Closes #384
Closes #385
Closes #386
Closes #387

[drips-wave]

@kanengchik Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits