Runtime bump, CI Machete move, and real response_size metric

[martsokha]

Summary

Housekeeping across three fronts: bump the runtime engine, tidy CI to match runtime's layout, and fix a long-standing metrics inaccuracy.

Runtime bump

Bump the nvisy-engine / runtime git dep to latest main (bd96ed9 → 3e805a7). No code changes required — check, clippy, and tests all pass against the new revision.

CI: move Machete from Security → Build

The unused-dependency check (cargo-machete) now lives in the Build workflow alongside the other build-quality gates (fmt, clippy, docs), matching the runtime repo's layout, instead of sitting in the Security workflow next to cargo-deny and secret scanning. Security keeps deny and the secret scan.

Fix: response_size metric was always 0

The metrics middleware read response_size from the response's Content-Length header, but axum wraps handler responses in a streaming body that carries no such header at the point the middleware runs — so every response logged response_size=0, even a 200 JSON one.

Add CountingBody, an http_body::Body wrapper that tallies data-frame bytes as they stream (never buffers) and fires a callback with the total at end-of-stream, or on early drop (client disconnect). The metrics middleware wraps the response body and emits the "request completed" line — now with the real byte count — from that callback. Correct for JSON, file/audit downloads, and SSE streams alike.

request_size is unchanged (the client's Content-Length is already correct for request bodies; 0 for bodyless GETs).

Behavior note: for a streamed response the "request completed" log now fires when the body finishes (for a long-lived SSE connection, when it closes) rather than at handler return — which is genuinely when the response completes.

Testing

Full gate green: cargo check, cargo clippy -D warnings, cargo test — all pass with the bumped runtime. cargo machete passes locally (the new http-body dep is used). Three unit tests cover CountingBody (completion count, empty body, early drop).

🤖 Generated with Claude Code