feat: add gzip/brotli response compression middleware

[aojomo]

Closes #218

---

Summary

API responses (analytics, transaction history, agent logs) were being returned uncompressed, wasting bandwidth and increasing latency — particularly on mobile connections.

This PR adds a global gzip + brotli response compression middleware to address that.

---

Changes

New: src/middleware/compression.ts

• Configures the compression package with a 1 KB threshold — responses smaller than this are sent uncompressed since the overhead outweighs the savings
• Brotli enabled at quality level 4 (good ratio/CPU balance) when client sends Accept-Encoding: br
• /metrics excluded via a filter callback — Prometheus scraper expects raw text/plain and manages its own transport encoding

Modified: src/index.ts

• Compression middleware wired globally after CORS and before body parsers/route handlers, ensuring all API responses are eligible

Modified: src/middleware/index.ts

• Barrel export added for compressionMiddleware

Modified: scripts/smoke-health.sh

• Compression smoke check added — verifies server returns HTTP 200 when Accept-Encoding: gzip, deflate, br is sent; fails CI with a ::error:: annotation otherwise

Modified: .env.example

• Documentation note added — no env vars required, compression is always active

New: tests/compression.test.ts

• 8 self-contained unit tests (no env vars / DB required)

---

Test Results

PASS tests/compression.test.ts

compressionMiddleware
gzip compression
✓ returns Content-Encoding: gzip on responses > 1 KB
✓ decompresses correctly — response body is valid JSON
brotli compression
✓ returns Content-Encoding: br on responses > 1 KB when br is advertised
✓ prefers br over gzip when both are advertised
threshold (< 1 KB)
✓ does NOT add Content-Encoding for responses under 1 KB
/metrics path exclusion
✓ does NOT add Content-Encoding for /metrics even when gzip is advertised
✓ does NOT add Content-Encoding for /metrics when br is advertised
✓ still serves /metrics content correctly when compression is excluded

Tests: 8 passed, 8 total

---

Acceptance Criteria

• Compression middleware applied globally before route handlers
• Brotli used when client advertises support
• /metrics excluded from compression
• Smoke test verifies compression with Accept-Encoding header

---

Dependencies

Package	Type	Version
compression	runtime	^1.8.1
@types/compression	dev	^1.8.1

[robertocarlous]

Resolve conflict

[drips-wave]

@aojomo Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits