feat: db pool metrics + bounded threat cache

[Mkalbani]

feat: DB pool metrics (#883) + bounded threat cache (#882)

#883 — DB connection pool metrics on Prometheus endpoint

• Renamed gauges to spec names: db_pool_active_connections, db_pool_waiting_requests.
• Added new gauges: db_pool_max_connections, db_pool_utilization (ratio active/max).
• DbPoolMetricsCollector polls every 15s; db_pool_max_connections and db_pool_utilization are set on every tick.
• Added Prometheus alert rule DBPoolUtilizationHigh (warning, 5m) firing on db_pool_utilization > 0.8 in infra/monitoring/alerts.yml. Existing 90% critical rule preserved.

Acceptance criteria

• Pool metrics appear on the Prometheus scrape endpoint (/metrics).
• Alert fires when active connections exceed 80% of the pool max.
• Metrics accurate under concurrent load — collected via pool.totalCount / idleCount / waitingCount per poll.

#882 — Bounded TTL cache in ThreatDetectionService

• Added lru-cache@^11.0.0 dependency.
• Replaced unbounded Map<string, number> with LRUCache<string, number> capped at 50,000 entries with 15-minute TTL (ttlAutopurge: true).
• Rate-limited Logger.warn fires on LRU eviction (≥60s between warnings) so a flood of evictions doesn't amplify load.
• Public surface (analyzeRequest, recordFailure, reset) unchanged; added getCacheSize / has for test introspection.

Acceptance criteria

• Map size bounded at 50,000 entries (unit test inserts 50,001, asserts size == 50,000 and first entry evicted).
• Entries expire after 15 minutes without manual reset (unit test with tiny TTL).
• Unit test verifies LRU eviction at the cap boundary.

Verification

• npx tsc -p tsconfig.build.json --noEmit — clean.
• npx jest src/monitoring/metrics/db-pool-metrics.collector.spec.ts src/security/threats/threat-detection.service.spec.ts — 15/15 pass.

Files changed

• package.json / package-lock.json — add lru-cache@^11.0.0.
• src/monitoring/metrics/metrics-collection.service.ts — rename + add gauges.
• src/monitoring/metrics/db-pool-metrics.collector.ts — 15s cron, new gauge writes.
• src/monitoring/metrics/db-pool-metrics.collector.spec.ts — updated + new tests.
• src/security/threats/threat-detection.service.ts — Map → bounded LRUCache.
• src/security/threats/threat-detection.service.spec.ts — new spec.
• infra/monitoring/alerts.yml — DBPoolUtilizationHigh 80% rule.

closes #882
closes #883

[drips-wave]

@Mkalbani Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits