Harden library for production-critical workloads

[gearnode]

Summary

• harden PostgreSQL pooling, TLS validation, advisory-locked migrations, and SQL trace redaction
• prevent HTTP SSRF proxy bypasses, bound client waits, sanitize telemetry, and reduce metric/span cardinality
• remove connection-level spans so unrelated keep-alive requests remain in independent traces
• improve application shutdown, secure OTLP defaults, configuration validation, secret redaction, and worker cancellation/panic handling
• upgrade vulnerable dependencies and strengthen CI with pinned tools, race tests, and govulncheck

Notable behavior changes

• metrics bind to 127.0.0.1:9090 by default
• OTLP/HTTP uses verified TLS at localhost:4318 by default; local plaintext collectors must set insecure: true
• outbound HTTP clients default to a 30-second total timeout and 15-second response-header timeout
• SQL query text is omitted from spans unless pg.WithTraceQueryText() is supplied
• tracing sampling defaults to 10%

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• staticcheck ./...
• golangci-lint run ./...
• govulncheck ./... (zero reachable vulnerabilities)
• goimports -d .
• git diff --check

PostgreSQL-backed tests retain their existing skip behavior when no database is available.