deps: upgrade all soulteary kits to their latest majors

[soulteary]

Every kit this project depends on cut a new major that moves framework- and
exporter-specific code out of its root package, so the root packages stop
linking Fiber, fasthttp, Prometheus/protobuf and the OTLP exporter into
consumers that do not ask for them. Go encodes the major in the import path, so
none of this arrives via go get -u — each one is a path change plus, where the
moved symbols are ones we call, a constructor rename.

Version changes

Module	From	To
httpcache-kit	/v2 v2.5.0	/v4 v4.0.0
logger-kit	/v2 v2.3.0	/v3 v3.0.0
metrics-kit	/v2 v2.2.0	/v3 v3.0.0
health-kit	/v2 v2.3.0	/v4 v4.0.0
middleware-kit	/v2 v2.2.0	/v3 v3.0.0
version-kit	/v2 v2.2.0	/v4 v4.0.0
tracing-kit	v1.5.0	/v2 v2.0.0
http-kit	v1.5.0	/v2 v2.0.0

cli-kit v1.9.0 and vfs-kit v1.4.2 were already current and are untouched. No
replace directives, and no compatibility shims for the removed APIs. go mod tidy also carried three transitive bumps the new kits require —
molecule-man/go-brrr v1.1.1, dustin/go-humanize v1.1.0 and
go.uber.org/atomic v1.12.0.

The first commit bumps httpcache-kit, logger-kit and metrics-kit together
on purpose: httpcache-kit's API takes the other two's types directly
(SetLogger, HandlerOptions.Logger, the metrics constructor), and a module
path is part of a type's identity, so a v2 value cannot satisfy a v3/v4
parameter. Split across commits it would not compile.

Code migrations

httpcache.NewCacheMetrics → prometheusmetrics.New

v4 moved the Prometheus recorder into a prometheusmetrics subpackage so the
root package no longer links client_golang. New still installs itself as
httpcache's default recorder, so the return value stays discarded exactly as
before:

-	httpcache.NewCacheMetrics(s.metricsRegistry)
+	prometheusmetrics.New(s.metricsRegistry)

The constructors were moved verbatim upstream, so the apt_proxy_cache_* metric
names, labels and buckets are unchanged.

MiddlewareConfig.CustomFieldsFiber → loggerfiber.Config.CustomFields

logger-kit v3 removed the fiber.Ctx-typed hooks from the root
MiddlewareConfig — those fields are what pulled Fiber into the root package in
the first place. They now live on fiberadapter.Config, which embeds the root
config, so logCfg is passed through untouched and the closure body is
unchanged:

-	logCfg.CustomFieldsFiber = func(c fiber.Ctx) map[string]interface{} {
-		...
-	}
-	app.Use(logger.FiberMiddleware(logCfg))
+	app.Use(loggerfiber.Middleware(loggerfiber.Config{
+		MiddlewareConfig: logCfg,
+		CustomFields: func(c fiber.Ctx) map[string]interface{} {
+			...
+		},
+	}))

Logger, SkipPaths and the Debug-only IncludeHeaders / IncludeBody still
come from logger.DefaultMiddlewareConfig(), so the access log keeps its
cache and size fields.

GetDefaultMetrics() nil check dropped

It used to return a *CacheMetrics that was nil until metrics were registered,
which nil-receiver methods made safe. In v4 it returns the Metrics interface
and never nil — "unset" is a real NopMetrics object — so the old guard would
now be a nil-interface panic waiting to happen:

-	if metrics := httpcache.GetDefaultMetrics(); metrics != nil {
-		metrics.UpdateCacheStats(stats)
-	}
+	httpcache.GetDefaultMetrics().UpdateCacheStats(stats)

The rest

Before	After
tracing.InitTracer(...)	otlp.InitTracer(...) (same args, same returns)
version.FiberMiddleware(info, "X-")	versionfiber.Middleware(info, "X-")
version.FiberHandler(cfg)	versionfiber.Handler(cfg) (HandlerConfig still root)
middleware.SecurityHeaders(cfg)	mwfiber.SecurityHeaders(cfg) (DefaultSecurityHeadersConfig still root)
health.FiberLivenessHandler(name)	healthfiber.LivenessHandler(name)

/healthz and /readyz keep the local fiberHealthHandler. The race with
fasthttp's graceful shutdown it exists to avoid is unchanged, so the kit's
aggregator handlers are still not what we want; the comments naming them were
updated to the new symbol names.

metrics.HandlerFor and metrics.NewRegistry stayed in metrics-kit's root
package, so /metrics needed only the import path. http-kit v2 removed
Client.InjectTraceContext, which this project never called — it uses only
RetryOptions and DefaultRetryOptions, both unchanged.

Everything else is import paths only: 8 files for httpcache-kit, 23 for
logger-kit, 2 for health-kit, 3 for tracing-kit, 2 for http-kit.

The -X ldflags in the Makefile inject main.version / main.commit /
main.date, not version-kit package variables, so the silent-dev trap in
version-kit's upgrade notes does not apply. Verified against a make build
binary below.

⚠️ /version response changed

Two documented behaviour changes in version-kit's Fiber adapter, both confirmed
against a pre-upgrade build, and neither avoidable without a shim:

before: Content-Type: application/json; charset=utf-8   {"version":"dev"}          (17 B)
after:  Content-Type: application/json                  {\n  "version": "dev"\n}   (22 B)

• Pretty now works. fiber.Ctx.JSON always wrote compact JSON, so the
  Pretty: true this endpoint has always been configured with was silently
  ignored. The config is kept as written rather than flipped to false to
  reproduce the old body — set Pretty: false in createFiberApp if the
  compact form is wanted back.
• Content-Type drops ; charset=utf-8, matching the net/http handler
  (RFC 8259 defines no charset parameter for application/json). Not
  configurable either way.

The X- version headers are unaffected.

Verification

go build ./..., go vet ./... (also with -tags=integration), go test ./..., make test (-race -short) and make test-integration
(-tags=integration -race) all pass.

Both old-path checks come back empty on tracked files:

grep -rnE 'soulteary/(httpcache|logger|metrics|health|middleware|version)-kit/v2' .
grep -rnP 'soulteary/(tracing|http)-kit(?!/v2)' --include='*.go' --include=go.mod .

golangci-lint could not be run here: the installed binary is built with Go
1.25 and refuses a go 1.27.0 module. That is pre-existing and unrelated to
this change; gofmt -l is clean and go vet passes.

Runtime, against a make build binary vs. a pre-upgrade build

Fetched /ubuntu/dists/noble/InRelease twice through the proxy:

fetch #1  X-Cache: MISS   {"path":"/ubuntu/dists/noble/InRelease","status":200,"cache":"MISS","size":255850}
fetch #2  X-Cache: HIT    {"path":"/ubuntu/dists/noble/InRelease","status":200,"cache":"HIT","size":255850}

• Access log cache and size fields correct on both.
• apt_proxy_cache_hits_total{method="GET"} and ..._misses_total{method="GET"}
  each at 1; the full apt_proxy_* series name + label set diffs clean against
  the pre-upgrade scrape.
• /api/cache/stats body byte-identical to pre-upgrade, and the
  apt_proxy_cache_item_count / _size_bytes gauges move from 0 to
  1 / 256230 after that call — which is the UpdateCacheStats path this PR
  changed.
• X-Version plus the four security headers unchanged; /livez, /healthz,
  /readyz byte-identical; version ldflags land (X-Version: 9fe1f10);
  graceful shutdown clean, no panics or races, and the log-message profile
  matches the pre-upgrade run line for line.

🤖 Generated with Claude Code

https://claude.ai/code/session_01S41m6kbkBFMd6tGe7eAxC5

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[soulteary]

lgtm