[claude] benchmarks-website-v3: alpha server (axum + maud + duckdb) (#7637)

## Summary

Implements the alpha server for `bench.vortex.dev` v3 per

[`benchmarks-website/planning/components/server.md`](../tree/ct/benchmarks-v3/benchmarks-website/planning/components/server.md).

A single Rust binary that owns a DuckDB file on local disk, accepts
authenticated `/api/ingest` POSTs, and serves a small read API plus a
placeholder HTML route the web-ui PR will replace.

- **Schema** (`src/schema.rs`): `commits` dim + the five fact tables
from
`01-schema.md`. DDL is applied on boot; no migration framework at alpha.
- **Ingest** (`src/ingest.rs`): bearer-auth middleware, all-or-nothing
transactions, idempotent upsert via per-table xxhash64 `measurement_id`,
  full HTTP matrix from `02-contracts.md` (200 / 400 / 401 / 409 / 500).
- **Read API** (`src/api.rs`): `/api/groups`, `/api/chart/:slug`,
`/health`.
  Slugs are opaque base64url-encoded JSON (`src/slug.rs`) so the web-ui
  treats them as strings per the contract.
- **Records** (`src/records.rs`): per-`kind` discriminated union with
`deny_unknown_fields`, so unknown `kind`s and unknown fields fail
loudly.
- **HTML** (`src/html.rs`): placeholder root route - replaced by web-ui.

## Stack

Pinned in `benchmarks-website/server/Cargo.toml`:

- `axum = "=0.7.9"` (`http1`, `json`, `tokio`, `query`)
- `maud = "=0.26.0"` with `axum`
- `duckdb = "=1.4.1"` with `bundled`
- `tower-http = "=0.6.8"` for tracing
- `subtle = "=2.6.1"` for constant-time bearer compare
- `twox-hash = "=2.1.0"` for the `measurement_id` xxhash64
- workspace `anyhow` + `thiserror` for errors

The crate is a leaf binary outside the `vortex-*` public-API surface, so
`./scripts/public-api.sh` is intentionally skipped per the task brief.

## Routes

| Method | Path | Auth |
|---|---|---|
| `POST` | `/api/ingest` | bearer |
| `GET`  | `/api/groups` | none |
| `GET`  | `/api/chart/:slug` | none |
| `GET`  | `/health` | none |
| `GET`  | `/` | none (placeholder, web-ui replaces) |

## Test plan

- [x] `cargo build -p vortex-bench-server`
- [x] `cargo test -p vortex-bench-server` - 14 tests pass (4 unit + 10
integration)
- [x] `cargo clippy -p vortex-bench-server --all-targets -- -D warnings`
- [x] `cargo fmt -p vortex-bench-server`
- [x] Manual `cargo run` smoke: `/health`, `POST /api/ingest` (with and
without
      bearer), `/api/groups`, `/api/chart/:slug` round-trip.

Acceptance criteria from `components/server.md`:

- [x] `cargo build` succeeds for the server crate.
- [x] Integration test: POST with valid bearer → 200; re-POST → 200 with
`updated > 0, inserted = 0`; no/wrong bearer → 401; unknown `kind` →
400.
- [x] `GET /health` returns coherent shape after an ingest (db_path,
      schema_version, latest_commit_timestamp, per-table row counts).
- [x] `cargo run` against a fresh DuckDB file serves both read routes.

## Coordination

The skeleton commit (`3266b87`) was pushed before the integration test
commit so the web-ui agent can rebase onto the workspace member without
waiting for tests.

Branch: `claude/benchmarks-v3-server` → `ct/benchmarks-v3` (not develop,
not main).

---
_Generated by [Claude
Code](https://claude.ai/code/session_01MPMnGUzXCUQvdkwbhSU9HR)_

---------

Signed-off-by: Claude <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Connor Tsui <connor.tsui20@gmail.com>

Author: connortsui20

.github/workflows/ci.yml

@@ -358,7 +358,8 @@ jobs:
         if: matrix.os == 'windows-x64'
         run: |
           cargo nextest run --cargo-profile ci --locked --workspace --all-features --no-fail-fast `
-            --exclude vortex-bench --exclude vortex-python --exclude vortex-duckdb `
+            --exclude vortex-bench --exclude vortex-bench-server `
+            --exclude vortex-python --exclude vortex-duckdb `
             --exclude vortex-fuzz --exclude vortex-cuda --exclude vortex-nvcomp `
             --exclude vortex-cub --exclude vortex-test-e2e-cuda --exclude duckdb-bench `
             --exclude lance-bench --exclude datafusion-bench --exclude random-access-bench `