fix: share HTTP client across workers, redact reports, harden servers (v1.7.1)

[ragilhadi]

Summary

A full review of v1.7.0 found one root cause that made both new load profiles report numbers the run never produced, plus a set of correctness, robustness and hygiene issues. This PR fixes all of them and bumps the version to 1.7.1.

Critical

• Executor::clone_for_worker() rebuilt a whole reqwest::Client (and connection pool) instead of reusing the executor's own one. Client construction costs several milliseconds — comparable to or larger than an arrival-rate pacing tick period, and enough to silently steal from a staged profile's stage durations. HttpClient is now Clone (Arc-backed) and workers share the executor's client.
• Staged-profile deadline was computed before workers were spawned. Slow worker startup (previously: per-worker client construction) was silently charged against configured stage durations, in the worst case leaving a stage with zero requests. Workers now wait on the deadline via a shared OnceLock, fixed only once every worker has actually started — mirroring how mark_load_phase_started() already works.
• Per-stage throughput divided by the planned stage duration, not what the stage actually got (relevant for a cancelled run, or before the deadline fix above). Now computed from observed wall-clock duration; both are kept in the report.
• generate_summary() was the one metrics accessor that panicked on a poisoned lock — after the load test finishes, so a panic there would discard a completed run's results. Now recovers, like every other accessor already does.

High

• Reports were redacted only when the live dashboard served them back, never when written to JSON/CSV. A connection error routinely quotes the request URL; an extracted token in a query string could reach a persisted report. Executor now redacts before recording.
• The CSV output channel was unbounded. A writer that falls behind (a slow disk) could make the collector buffer an unbounded backlog. Now bounded with an explicit drop-and-count policy (csv_dropped_rows in the summary), and a write failure logs once instead of surfacing only at the end.
• Terminal live RPS used the whole-run average, unlike the dashboard's snapshot which already uses a 5-second window — lagged badly during a ramp or stage transition. Now shares the same windowed calculation.
• The Prometheus endpoint always bound 0.0.0.0 with no way to narrow it, unlike the dashboard which defaults to loopback. Added prometheus_bind (default 127.0.0.1), with the same non-loopback warning the dashboard already has. This is a default-behavior change — configs relying on the endpoint being reachable from other hosts need prometheus_bind: 0.0.0.0 explicitly.
• Both Prometheus and dashboard accept loops died on any transient accept() error (e.g. an exhausted FD table under load), taking the whole endpoint down for the rest of the run. Now logged and the loop continues.
• Dashboard connections had no read timeout or concurrency cap. Added a 10s read timeout and a connection-count cap (extra connections are closed immediately, not queued).

Medium / correctness

• extract_variables() re-parsed the response body once per extracted variable instead of once per scenario step.
• Multipart file uploads were re-read from disk on every request; now cached (capped) by resolved path.
• Variable substitution did per-variable String::replace passes (order-dependent under HashMap iteration, and a substituted value could be mistaken for another placeholder). Rewritten as a single pass over the original template. URL substitution now percent-encodes inserted values. The "unresolved {{ var }}" guard — previously multipart-only — now also covers the URL, headers and body.
• load_profile.stages validated an all-zero-concurrency profile (sends no traffic all run); now rejected, while a single zero-concurrency stage (a legitimate ramp-down, per samples/staged-load-profile.yaml) still validates with a warning.
• load_profile.max_concurrency is drained with a u32 permit count; a value too large to fit would silently truncate. Now rejected at config validation.
• The UI progress ticker only stopped on cancellation or its own elapsed counter — an executor error or a profile that finished short of total_secs left it idling for the rest of the originally planned duration before the summary could print. Also fixed a one-tick timing drift from interval's immediate first tick.

Hygiene

• Cargo.lock was gitignored on a binary crate — committed (CI's cache keys already hash it, so caching starts working correctly too).
• Docker image now runs as a non-root user; dropped pkg-config/libssl-dev from the builder (nothing links them — reqwest resolves rustls here). Not exercised with a live docker build/docker run in the environment this was authored in (no Docker daemon available there) — worth a manual check.
• make dev passed a bare positional arg the CLI hasn't accepted since the compare subcommand shipped; fixed to --config.
• make clean-all deleted the (now-committed) lockfile; dropped that step.
• README documents the new prometheus_bind setting.

Correction to my own earlier review pass: I initially flagged "no CI runs the tests" — that was wrong, from a glob that missed .github/workflows/unit-test.yaml's .yaml extension. That workflow already runs fmt/clippy/build/test on every PR; no new workflow was added here.

Deliberately out of scope (flagged as separate follow-ups, not bundled in to keep this diff reviewable): migrating off the deprecated serde_yaml crate, and teaching flux compare to record/compare the load configuration two reports were generated under.

Test plan

• cargo test — 154 passed, 0 failed (up from 138 on master; new regression tests added for each fix)
• cargo clippy --all-targets -- -D warnings — clean
• cargo fmt --check — clean
• cargo build --release — succeeds, --version reports 1.7.1
• Reproduced the staged-profile and arrival-rate bugs against a local server before fixing, and confirmed the fix with the same repro (see commit messages)
• Docker build/run — not exercised in the authoring environment; please verify before/after merge

---

Generated by Claude Code