[LFXV2-1737] feat(otel): instrument outbound HTTP clients

[bramwelt]

Summary

Part of LFXV2-1737.

• Wraps the JWKS HTTP client with otelhttp.NewTransport so Heimdall key-fetch requests appear as child spans in distributed traces
• Wraps the Auth0 HTTP client with otelhttp.NewTransport so token acquisition appears in traces; Auth0 spans are independent (not child spans of inbound requests) because the token source uses context.Background() — it is shared and cached across requests
• Wraps the ITX API HTTP client with otelhttp.NewTransport so ITX calls appear as child spans of inbound request spans
• Adds jwksClientTimeout (10s) to bound JWKS fetch time; uses config.Timeout for the Auth0 client
• Fixes stdlib import grouping (net/http moved into stdlib group per goimports)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds OpenTelemetry instrumentation to outbound HTTP calls so external dependencies (Heimdall JWKS fetch, Auth0 token acquisition, and ITX API calls) show up in distributed traces, and bounds JWKS fetch latency with an explicit timeout.

Changes:

• Wrap Auth0 and ITX HTTP client transports with otelhttp.NewTransport for outbound span creation.
• Add an otel-instrumented JWKS HTTP client and enforce a jwksClientTimeout (10s) for key retrieval.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
internal/infrastructure/proxy/client.go	Instruments Auth0 token and ITX API outbound HTTP transports with otelhttp.
internal/infrastructure/auth/jwt.go	Instruments JWKS fetch client with otelhttp and adds a 10s JWKS client timeout.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bramwelt]

Review Feedback Addressed

Commit: 623aec8

Changes Made

• internal/infrastructure/proxy/client.go: Updated the otelClient comment to accurately state it is used for Auth0 token requests only; ITX API calls are instrumented separately via httpClient (per copilot-pull-request-reviewer)

Threads Resolved

1 of 1 unresolved threads addressed.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[bramwelt]

Review Feedback Addressed

No Code Change Needed

• internal/infrastructure/proxy/client.go:94: copilot-pull-request-reviewer flagged that Auth0 token spans won't be child spans of inbound requests. This is intentional — the auth0TokenSource uses context.Background() because it is shared and cached via oauth2.ReuseTokenSource. Tying it to a per-request context would cause token fetches to be canceled prematurely.

PR Descriptions Updated

Updated descriptions on all 4 affected PRs (voting #37, meeting #182, mailing-list #64, survey #26) to accurately describe the tracing behavior:

• Auth0 token-fetch spans → independent root spans (not child spans)
• ITX API call spans → child spans of inbound request spans

Threads Resolved

1 of 1 unresolved threads addressed in this iteration.