fix: comprehensive audit — 66 security/correctness/performance findings resolved

.github/FUNDING.yml

@@ -0,0 +1,10 @@
+# Arvik — Funding options
+# This file adds the "Sponsor" button to the GitHub repository.
+# Docs: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
+
+github:
+  - aarambh-darshan
+
+custom:
+  - "https://buymeacoffee.com/aarambhdevhub"
+  - "https://razorpay.me/@aarambhdevhub"

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,49 @@
+---
+name: Bug Report
+about: Something is broken or behaving unexpectedly
+title: "fix: "
+labels: bug
+assignees: ""
+---
+
+## Description
+
+A clear, one-paragraph description of the bug.
+
+## Minimal Reproduction
+
+```rust
+// The smallest possible code that demonstrates the bug.
+// Remove everything unrelated.
+// This must compile (or explain why it doesn't).
+use arvik::{Router, get, serve_app};
+
+#[tokio::main]
+async fn main() {
+    let app = Router::new()
+        .route("/", get(|| async { "hello" }));
+    // reproduce the bug here
+    serve_app("127.0.0.1:8080", app).await.unwrap();
+}
+```
+
+## Expected Behavior
+
+What you expected to happen.
+
+## Actual Behavior
+
+What actually happened. Include the full error message, panic output, or unexpected value.
+
+## Environment
+
+| | |
+|---|---|
+| Arvik version | `0.9.x` |
+| Rust version | `rustc --version` output |
+| OS | e.g. Pop OS 22.04 / macOS 14 / Windows 11 |
+| Active features | e.g. `default`, `tls`, `ws`, `config`, `macros` |
+
+## Additional Context
+
+Anything else that might be relevant — related issues, workarounds you've tried, etc.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,35 @@
+---
+name: Feature Request
+about: Suggest a new feature or API improvement
+title: "feat: "
+labels: enhancement
+assignees: ""
+---
+
+## Use Case
+
+What are you trying to accomplish? Describe the problem you are solving, not the solution you want.
+A good use case sounds like: "I need to stream server-sent events with per-client backpressure but the current API requires Y workaround."
+
+## Proposed API
+
+Show what you would want to write. Code is clearer than prose.
+
+```rust
+// Example of the API you'd like to exist:
+let app = Router::new()
+    .route("/events", get(events_handler))
+    .layer(YourNewLayer::new());
+```
+
+## Alternatives Considered
+
+What can you do today instead? Why is it insufficient?
+
+## Affected Crate(s)
+
+Which crate(s) would this change? e.g. `arvik-core`, `arvik-router`, `arvik-middleware`, `arvik-hyper`, `arvik-extract`, `arvik-ws`, `arvik-sse`, `arvik-static`, `arvik-tls`, `arvik-config`, `arvik-observe`
+
+## Additional Context
+
+Links to prior art (axum, actix-web, tower-http…), related issues, or any other context that helps evaluate the request.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,37 @@
+## Summary
+
+Brief description of what this PR does and why.
+
+Closes #<!-- issue number -->
+
+---
+
+## Type of Change
+
+- [ ] Bug fix — non-breaking, fixes incorrect behavior
+- [ ] New feature — non-breaking, adds functionality
+- [ ] Breaking change — changes existing behavior or API
+- [ ] Documentation — no behavior change
+- [ ] Performance — no behavior change, improves speed or memory
+- [ ] Refactor — no behavior change, improves code structure
+- [ ] Test — adds or improves test coverage
+- [ ] CI / build — changes to workflow or build configuration
+
+---
+
+## Checklist
+
+- [ ] `cargo fmt` has been run — code is formatted
+- [ ] `cargo clippy --workspace --all-features -- -D warnings` is clean
+- [ ] `cargo test --workspace --all-features` passes
+- [ ] `cargo check --workspace` passes without default features
+- [ ] New or changed public APIs have `///` doc comments with examples
+- [ ] `cargo doc --workspace --all-features --no-deps` builds without warnings
+- [ ] `CHANGELOG.md` has been updated under `[Unreleased]`
+- [ ] Tests are included for new behavior or bug fixes
+
+---
+
+## Notes for Reviewers
+
+Anything the reviewer should pay particular attention to, tricky parts of the implementation, or decisions you were uncertain about.

.github/release-notes/0.9.5.md

@@ -0,0 +1,83 @@
+## Arvik v0.9.5 — Performance Sprint
+
+Arvik v0.9.5 is the performance-focused release: low-level socket and listener
+tuning, HTTP/2 presets, lower-copy `Body` constructors, and a manual benchmark
+harness for measuring all of it.
+
+### Highlights
+
+- Low-level socket/listener tuning on `ServerConfig`: TCP_NODELAY, keepalive,
+  reuse port/address, backlog, socket buffers, and accept worker settings.
+- HTTP/2 performance presets: `ServerConfig::http2_low_latency()` and
+  `ServerConfig::http2_high_throughput()`.
+- `RuntimeConfig` for tuned Tokio runtime construction.
+- Optional `runtime-metrics` facade feature forwarding to
+  `arvik-hyper/runtime-metrics`.
+- Lower-copy `Body` constructors: `from_static`, `from_chunks`, and
+  `is_empty_hint`.
+- Benchmark examples under `examples/benchmarks` and a tuning example under
+  `examples/performance_tuning`.
+- Manual benchmark workflow that uploads benchmark artifacts.
+- `scripts/bench/wrk.sh`, `scripts/bench/hey.sh`, and
+  `scripts/bench/run-all.sh`.
+
+### Changed
+
+- Router matched paths now use interned `Arc<str>` metadata.
+- Path parameter keys use stack-backed `SmallVec` storage with interned names.
+- JSON responses serialize into `BytesMut` and freeze into `Bytes`.
+- Arvik config maps socket/listener settings into `ServerConfig`.
+- Workspace version bumped to `0.9.5`.
+
+### Notes
+
+- The planned full Linux `io_uring` backend is deferred as future experimental
+  work. The 0.9.x completion path is maintainable Tokio/socket tuning plus
+  optional runtime metrics.
+- Benchmark CI is manual and artifact-based, not PR-commenting or release
+  gating.
+
+### Compatibility
+
+No public Rust API was removed or renamed. New `ServerConfig` methods are
+additive; existing configurations continue to work unchanged.
+
+### Install
+
+```toml
+[dependencies]
+arvik = "0.9.5"
+```
+
+With TLS, WebSocket, and configuration support:
+
+```toml
+[dependencies]
+arvik = { version = "0.9.5", features = ["tls", "ws", "config"] }
+```
+
+### Crates published to crates.io
+
+| Crate | Version | Description |
+|-------|---------|-------------|
+| `arvik-core` | `0.9.5` | Core traits, request/response types, extractors |
+| `arvik-router` | `0.9.5` | Radix-trie router and method dispatch |
+| `arvik-hyper` | `0.9.5` | Hyper-based server with graceful shutdown |
+| `arvik-extract` | `0.9.5` | Body/multipart/cookie extractors |
+| `arvik-middleware` | `0.9.5` | CORS, auth, rate limiting, compression |
+| `arvik-ws` | `0.9.5` | WebSocket upgrades and sockets |
+| `arvik-sse` | `0.9.5` | Server-sent events |
+| `arvik-static` | `0.9.5` | Static file and embedded asset serving |
+| `arvik-tls` | `0.9.5` | rustls + native-tls backends |
+| `arvik-macros` | `0.9.5` | Route and handler proc macros |
+| `arvik-test` | `0.9.5` | Test client utilities |
+| `arvik-config` | `0.9.5` | File/env runtime configuration |
+| `arvik-observe` | `0.9.5` | Metrics, logging, tracing, health checks |
+| `arvik` | `0.9.5` | Stable facade crate |
+
+### Documentation
+
+- [README](../../README.md)
+- [Architecture](../../ARCHITECTURE.md)
+- [Roadmap](../../ROADMAP.md)
+- [Changelog](../../CHANGELOG.md)