feat: performance budget and telemetry for time-to-first-proof (#432)

[iyanumajekodunmi756]

Summary

Closes #432.

Proving time is the core UX metric for StellarCred but was never tracked. This PR establishes explicit performance budgets, measures time-to-first-proof and per-stage timings (witness, prove, submit) locally for every proof, surfaces them in a debug view, and adds an opt-in channel for reporting only anonymized, device-class-bucketed aggregates so regressions can be spotted.

The implementation is deliberately privacy-safe: no wallet address, no commitment, no credential values — only the circuit kind, a coarse device class (core/memory counts), and raw timing numbers.

Problem

• Nobody could answer "how long does a proof take, and where does the time go?" — witness (server), prove (browser WASM), submit (on-chain) were never measured.
• No explicit budget existed, so "too slow" was only a user-perceived gut feeling rather than a flaggable, objective signal.
• No debug view or telemetry pipeline existed to defend the heaviest UX metric against regressions across device classes.

What was added

1. lib/proof-perf.ts — slim measurement core (statically imported by the holder page)

• ProofRunTracker + createProofRun(): times stages via measure("witness" | "prove" | "submit", fn, warm?) (durations recorded in finally, so failed stages still produce timings), computes timeToFirstProofMs (witness + prove) and totalMs (incl. submission), and records a bounded history (last 50) in localStorage.
• Explicit budgets in PROOF_PERF_TARGETS (witness 20s, prove 60s, submit 15s, total 90s — derived from the existing "~10–20s" UX estimate and the 120s proof timeout). Any stage/total over target sets exceededBudget for flagging.
• recordSubmit(ms) attaches the on-chain submission stage to the same run afterwards.
• Anonymized device class from hardwareConcurrency / deviceMemory; no identity data anywhere.

2. lib/telemetry-reporter.ts + lib/proof-telemetry.ts — aggregates & opt-in reporting (dynamically imported only)

• summarizeProofs() → per-stage avg/p50/min/max + over-budget counts.
• isTelemetryOptIn / setTelemetryOptIn (localStorage flag) and reportOptedInRuns() → POSTs only not-yet-reported runs to the server; never throws, so reporting can never break proving.

3. POST /api/proof-telemetry (app/api/proof-telemetry/route.ts)

• Lightweight, in-memory aggregator keyed by device class (running avg/min/max TTFP, over-budget count, warm-count, per-stage aggregates).
• Validates payload shape (bounded batch size, finite non-negative durations, bounded strings), ignores unknown fields, and never stores or echoes anything identity-like.

4. Holder page instrumentation (app/holder/page.tsx, lib/proof.ts)

• ProofFlow (single) and BatchProofFlow (batch) now wrap witness/prove/submit with the tracker; errored runs are recorded with the failing stage attributed.
• lib/proof.ts gained isProverWarm(type) so runs can distinguish cold vs. warm proving.
• New "Perf" toggle opens a lazily-loaded debug panel (components/ProofPerfPanel.tsx, next/dynamic, ssr: false) showing per-run and aggregate timings, over-budget flags, the opt-in toggle, a Report button, and Clear.

5. Bundle budget

• Holder route grew ~1 kB of runtime instrumentation; raised its size budget 16 kB → 18 kB in .size-limit.json (same approach the repo took in Add issuer reputation stats, delegated verification, and selective disclosure presets #483 when it raised the shared budget for feature growth).

Verification

All CI-equivalent checks pass locally:

• pnpm tsc --noEmit ✅
• pnpm lint ✅
• pnpm test — all 320 tests pass (incl. new lib/proof-perf.test.ts and app/api/proof-telemetry route tests; the proof-perf suite uses faked clocks for deterministic stage timings) ✅
• pnpm build (production, with CI env vars) ✅
• pnpm size — Holder 17.02 kB / 18 kB, Shared 720.48 kB / 740 kB, all other routes under budget ✅
• pnpm test:theme ✅ and pnpm --filter @stellarcred/issuer test ✅

Notes

• The debug panel is closed by default, so the axe/e2e a11y scan of /holder is unaffected.
• No configuration or new dependencies introduced. Telemetry is off unless the user explicitly opts in.

closes #432

[drips-wave]

@iyanumajekodunmi756 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Psalmuel01]

The time-to-first-proof telemetry (#432) is good work. It now conflicts with main though: #489 (preflight simulation) just merged and also edits frontend/app/holder/page.tsx. Please rebase onto latest main and fold the perf panel into the current holder page. Two things to confirm after rebasing: the telemetry stays opt-in with no PII (anonymized aggregates only), and if you bumped .size-limit.json, note that the shared-chunk budget is now 740 kB on main, so rebase that value rather than overwriting it.

[Psalmuel01]

Still conflicting with main (holder/page.tsx moved again with #489). Please rebase. Same notes as before: keep the telemetry opt-in and PII-free, and if you touch .size-limit.json the shared-chunk budget on main is now 740 kB, so rebase that value rather than overwrite it.