Per-phase timing capture for proxy requests

[stuartc]

Summary

• Breaking: finished_result.duration_us is replaced by a timing map containing total_us (same value) plus per-phase breakdown fields
• New collect_timing: true option for proxy/2 enables timing capture from Finch telemetry events
• New Philter.Timing module with a single globally-attached telemetry handler (lazy, near-zero cost when unused)

Timing structure

When collect_timing: true:

result.timing
# => %{total_us: 12500, queue_us: 200, connect_us: 3100, send_us: 150, recv_us: 8900,
#       idle_time_us: 50, reused_connection?: false}

When collect_timing is not set (default):

result.timing
# => %{total_us: 12500, queue_us: nil, connect_us: nil, send_us: nil, recv_us: nil,
#       idle_time_us: nil, reused_connection?: nil}

Design

• Transport-agnostic naming — field names don't reference Finch; semantics survive a client swap
• Single global handler — attached once via persistent_term guard, avoids O(N²) attach/detach per request
• Process dictionary opt-in — handler checks Process.get(:philter_timing_ref) on every Finch event; returns nil immediately when no proxy is capturing
• Cleanup on crash — catch clause in stream_with_timing/5 cleans up process dictionary entries before re-raising

Migration

- result.duration_us
+ result.timing.total_us

All timing keys are always present. Phase fields are nil unless collect_timing: true is passed.

Test plan

• Philter.Timing unit tests (11 tests): attachment idempotency, round-trip capture, duration conversion, cleanup, mutual exclusivity, edge cases
• PhilterTest integration tests updated for new timing structure + new timing-specific tests (139 total, 0 failures)
• mix compile --warnings-as-errors clean
• mix format --check-formatted clean