perf(observability): tag APM spans with matched Express route (#635)

* perf(observability): tag APM spans with Express route (LFXV2-1637)

Add an applyCustomAttributesOnSpan hook on HttpInstrumentation that
sets http.route to req.baseUrl + req.route.path and updates the span
name to METHOD ROUTE. Datadog uses these to compute resource_name, so
spans now bucket by endpoint (e.g. GET /api/meetings/:id) instead of
bare HTTP method.

For SSR catch-all routes where req.route isn't set, fall back to
bucketing by first URL segment (e.g. /meetings/*) so SSR latency is
no longer lumped into a single GET bucket.

Signed-off-by: Asitha de Silva <asithade@gmail.com>

* fix(observability): bucket root SSR requests under route '/'

Address PR #635 review feedback from coderabbitai, copilot[bot]:

- otel.mjs: handle root path in SSR fallback so http.route is set
  to '/' when URL has no segments. Previously, requests to '/' left
  http.route unset and landed in the bare GET resource bucket — the
  exact problem this PR set out to fix. The root dashboard route
  (app.routes.ts path: '') is real SSR traffic, so this matters.

Resolves 2 review threads.

Signed-off-by: Asitha de Silva <asithade@gmail.com>

* fix(review): address PR #635 review feedback

Address review comments from copilot-pull-request-reviewer:

- otel.mjs: skip pure wildcard route paths ('**', '*', '/*', '/**')
  so static-asset fallthrough does not collapse SSR spans into
  GET ** (per copilot[bot])
- otel.mjs: strip trailing slash from concatenated routes so
  router.get('/') mounts (e.g. /api/meetings/) bucket as their
  canonical path (per copilot[bot])
- otel.mjs: bucket single-segment fallback URLs as exact paths
  (e.g. /login) instead of /login/*, since they are concrete
  endpoints not prefixes (per copilot[bot])

Resolves 4 review threads.

Signed-off-by: Asitha de Silva <asithade@gmail.com>

---------

Signed-off-by: Asitha de Silva <asithade@gmail.com>

Author: asithade

apps/lfx-one/otel.mjs

@@ -107,6 +107,41 @@ if (!otlpEndpoint) {
           const url = req.url || '';
           return url === '/health' || url === '/api/health' || url.startsWith('/.well-known');
         },
+        applyCustomAttributesOnSpan: (span, request, response) => {
+          const req = 'req' in response ? response.req : undefined;
+          if (!req) return;
+
+          const routePath = req.route?.path;
+          // Skip pure wildcard route paths ('**', '*', '/*', '/**') leaked from
+          // static-asset fallthrough — they collapse SSR traffic into a single bucket.
+          const isWildcardOnly = typeof routePath === 'string' && /^\/?\*+$/.test(routePath);
+
+          if (routePath && !isWildcardOnly) {
+            const baseUrl = req.baseUrl || '';
+            let fullRoute = `${baseUrl}${routePath}`;
+            // Strip trailing slash from mounted router root (e.g. `/api/meetings/` → `/api/meetings`).
+            if (fullRoute.length > 1 && fullRoute.endsWith('/')) {
+              fullRoute = fullRoute.slice(0, -1);
+            }
+            span.setAttribute('http.route', fullRoute);
+            span.updateName(`${request.method} ${fullRoute}`);
+            return;
+          }
+
+          const url = (req.originalUrl || req.url || '').split('?')[0];
+          const segments = url.split('/').filter(Boolean);
+          let bucket;
+          if (segments.length === 0) {
+            bucket = '/';
+          } else if (segments.length === 1) {
+            // Single-segment URLs (e.g. `/login`) are concrete endpoints, not prefixes.
+            bucket = `/${segments[0]}`;
+          } else {
+            bucket = `/${segments[0]}/*`;
+          }
+          span.setAttribute('http.route', bucket);
+          span.updateName(`${request.method} ${bucket}`);
+        },
       }),
       new ExpressInstrumentation(),
       new UndiciInstrumentation({