Add CodSpeed performance benchmarks and CI workflow

[codspeed-hq]

Summary

This PR sets up continuous performance measurement with CodSpeed for AudioMuse-AI. It adds a pytest-based benchmark suite covering dependency-light hot paths, a GitHub Actions workflow to run those benchmarks on every push and pull request, and a CodSpeed badge in the README.

What was added

• test/benchmarks/ — a new benchmark suite built on pytest-codspeed:
  • test_bench_sanitization.py — benchmarks the string/JSON sanitization helpers in sanitization.py that run on every database write and API response (NUL/control-character stripping, nested-JSON sanitization, and numpy-to-native conversion), using realistic payload sizes.
  • test_bench_playlist_ordering.py — benchmarks the pure sonic-ordering distance helpers in tasks/playlist_ordering.py (_key_distance, _composite_distance) that drive the greedy nearest-neighbour walk used when sequencing playlists.
  • requirements.txt — minimal dependencies for the suite (numpy pinned to 1.26.4 to match requirements/common.txt, plus pytest and pytest-codspeed).
• .github/workflows/codspeed.yml — runs the benchmarks in CodSpeed's simulation (instrumentation) mode on ubuntu-latest, using CodSpeedHQ/action@v4 with OpenID Connect authentication.
• README.md — added the CodSpeed badge alongside the existing badges.

Approach

The benchmarks intentionally target self-contained, CPU-bound functions that can be imported without the project's heavy runtime dependencies (sklearn, torch, redis, a live database, etc.). This keeps the CI job fast and stable while still tracking code that runs on real hot paths. The existing repository conventions are respected: every new file carries the AGPL house header and a Main Features: docstring, and all source is plain ASCII, so the repo's header/emoji/em-dash guard tests continue to pass.

simulation mode is used because it is the recommended mode for CPU-bound Python code: it provides deterministic, hardware-agnostic measurements (sub-1% variance) and automatic flamegraphs, so no macro runners are required.

Verification

The suite was run locally through the CodSpeed CLI in simulation mode and all 6 benchmarks pass and report results successfully.

Next steps

• Merge to start tracking performance over time; CodSpeed will comment on future PRs with performance diffs.
• Extend coverage to additional hot paths (e.g. clustering scoring, IVF batch serialization) if their dependencies can be isolated cheaply.

[codspeed-hq]

Congrats! CodSpeed is installed 🎉

🆕 6 new benchmarks were detected.

You will start to see performance impacts in the reports once the benchmarks are run from your default branch.

Detected benchmarks

• test_bench_composite_distance: 246.4 ms
• test_bench_key_distance: 4.5 ms
• test_bench_sanitize_db_field: 1.1 ms
• test_bench_sanitize_for_json: 476.2 µs
• test_bench_sanitize_json_for_db: 2.3 ms
• test_bench_sanitize_string_for_db: 196.3 µs

---

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!