perf: add bench/memray/locust tooling + fix i18n dict-copy allocation

[antosubash]

Summary

• Adds a performance harness — pytest-benchmark, memray, and locust — wired through the Makefile (make bench, make memray-run, make loadtest, make loadtest-memray) so the project can measure CPU, allocations, and load behavior without ad-hoc scripts.
• Fixes the top own-code allocation site surfaced by that harness: build_i18n_block was copying the i18n messages dict on every Inertia render. A new I18nRegistry.messages_snapshot(locale) caches the plain-dict copy at load() time.

What changed

Tooling

• pytest-benchmark>=4.0, memray>=1.14 (non-Windows), locust>=2.31 added to the dev group.
• perf pytest marker gates benchmarks out of the default pytest run; make bench opts them in. A sample benchmark against forge_session_cookie demonstrates the pattern.
• make memray-run / make memray-flamegraph record and render allocation profiles of any Python target (defaults to the benchmark suite).
• make loadtest drives an already-running make dev; make loadtest-memray starts uvicorn under memray, seeds an admin, drives it with locust, shuts down (process-tree-aware) and emits an HTML flamegraph.
• scripts/loadtest_seed.py mints a signed Starlette session cookie so the locustfile's AuthedUser exercises real product-service code paths (bypasses the login rate limiter under load).
• .memray/ and .benchmarks/ added to .gitignore.

Fix

• framework/core/simple_module_core/i18n.py: add messages_snapshot(locale) -> dict[str, str] that returns a plain-dict copy built once at load() time. Rationale recorded in the docstring.
• framework/hosting/simple_module_hosting/_inertia_shared.py: switch the hot Inertia shared-props path from dict(registry.messages(locale)) (per-request copy) to registry.messages_snapshot(locale).

Why

Under make loadtest-memray with 100 users / 30s of authenticated traffic, build_i18n_block was the #6 allocation site with ~37K allocations and ~58 MB of churn per run — for data that is immutable within a process. The surrounding code had a comment explaining the copy was required because Inertia's JSON encoder doesn't accept MappingProxyType; moving the copy to load-time is a one-off rather than per-request.

After the fix, the function is no longer in the top-50 sites. Remaining hotspots (starlette.routing.Route.matches, itsdangerous signing, json.iterencode, sqlalchemy.await_only, inertia.templating) are all vendored framework code.

Measurements (100 users, 30s, authenticated scenarios)

metric	before	after	Δ
Requests / failures	9,210 / 0	9,240 / 0	—
Throughput	308 req/s	310 req/s	—
p99 latency	25 ms	21 ms	flat
Total allocations	1,582,505	1,547,720	−34,785
Total memory churned	2.214 GB	2.155 GB	−59 MB
Peak RSS	65.7 MB	65.5 MB	—
build_i18n_block rank	#6 (37K allocs)	not in top-50	removed

Test plan

• uv run pytest framework/core/tests/test_i18n.py framework/hosting/tests/ → 136 passed
• make bench runs the sample benchmark and prints timings
• make loadtest-memray (default args) seeds a user, profiles a full run, and emits a flamegraph; port is freed on exit
• 100u/30s run before-and-after confirms build_i18n_block drops out of the top allocation sites