feat: add e2e tests, perf benchmarks, and infrastructure improvements

- messages/bench_test.go: serialization benchmarks (msgpack map vs struct vs protobuf)
- clients/clients_test.go: HTTP client tests with pooling verification (20 tests)
- natsutil/natsutil_test.go: encode/decode roundtrip + binary data tests
- handler/handler_test.go: handler dispatch tests + benchmark
- config/config.go: live reload via fsnotify + RWMutex getter methods
- clients/clients.go: SharedTransport + sync.Pool buffer pooling
- messages/messages.go: typed structs with msgpack+json tags
- messages/proto/: protobuf schema + generated code

Benchmark baseline (ChatRequest roundtrip):
  MsgpackMap:    2949 ns/op, 36 allocs
  MsgpackStruct: 2030 ns/op, 13 allocs (31% faster, 64% fewer allocs)
  Protobuf:       793 ns/op,  8 allocs (73% faster, 78% fewer allocs)

config/config_test.go

@@ -1,42 +1,123 @@
 package config
 
 import (
-	"os"
-	"testing"
-	"time"
+"os"
+"path/filepath"
+"testing"
+"time"
 )
 
 func TestLoadDefaults(t *testing.T) {
-	s := Load()
-	if s.ServiceName != "handler" {
-		t.Errorf("expected default ServiceName 'handler', got %q", s.ServiceName)
-	}
-	if s.HealthPort != 8080 {
-		t.Errorf("expected default HealthPort 8080, got %d", s.HealthPort)
-	}
-	if s.HTTPTimeout != 60*time.Second {
-		t.Errorf("expected default HTTPTimeout 60s, got %v", s.HTTPTimeout)
-	}
+s := Load()
+if s.ServiceName != "handler" {
+t.Errorf("expected default ServiceName 'handler', got %q", s.ServiceName)
+}
+if s.HealthPort != 8080 {
+t.Errorf("expected default HealthPort 8080, got %d", s.HealthPort)
+}
+if s.HTTPTimeout != 60*time.Second {
+t.Errorf("expected default HTTPTimeout 60s, got %v", s.HTTPTimeout)
+}
 }
 
 func TestLoadFromEnv(t *testing.T) {
-	os.Setenv("SERVICE_NAME", "test-svc")
-	os.Setenv("HEALTH_PORT", "9090")
-	os.Setenv("OTEL_ENABLED", "false")
-	defer func() {
-		os.Unsetenv("SERVICE_NAME")
-		os.Unsetenv("HEALTH_PORT")
-		os.Unsetenv("OTEL_ENABLED")
-	}()
+t.Setenv("SERVICE_NAME", "test-svc")
+t.Setenv("HEALTH_PORT", "9090")
+t.Setenv("OTEL_ENABLED", "false")
 
-	s := Load()
-	if s.ServiceName != "test-svc" {
-		t.Errorf("expected ServiceName 'test-svc', got %q", s.ServiceName)
-	}
-	if s.HealthPort != 9090 {
-		t.Errorf("expected HealthPort 9090, got %d", s.HealthPort)
-	}
-	if s.OTELEnabled {
-		t.Error("expected OTELEnabled false")
-	}
+s := Load()
+if s.ServiceName != "test-svc" {
+t.Errorf("expected ServiceName 'test-svc', got %q", s.ServiceName)
+}
+if s.HealthPort != 9090 {
+t.Errorf("expected HealthPort 9090, got %d", s.HealthPort)
+}
+if s.OTELEnabled {
+t.Error("expected OTELEnabled false")
+}
+}
+
+func TestURLGetters(t *testing.T) {
+s := Load()
+if s.EmbeddingsURL() == "" {
+t.Error("EmbeddingsURL should have a default")
+}
+if s.RerankerURL() == "" {
+t.Error("RerankerURL should have a default")
+}
+if s.LLMURL() == "" {
+t.Error("LLMURL should have a default")
+}
+if s.TTSURL() == "" {
+t.Error("TTSURL should have a default")
+}
+if s.STTURL() == "" {
+t.Error("STTURL should have a default")
+}
+}
+
+func TestURLGettersFromEnv(t *testing.T) {
+t.Setenv("EMBEDDINGS_URL", "http://embed:8000")
+t.Setenv("LLM_URL", "http://llm:9000")
+
+s := Load()
+if s.EmbeddingsURL() != "http://embed:8000" {
+t.Errorf("expected custom EmbeddingsURL, got %q", s.EmbeddingsURL())
+}
+if s.LLMURL() != "http://llm:9000" {
+t.Errorf("expected custom LLMURL, got %q", s.LLMURL())
+}
+}
+
+func TestReloadFromSecrets(t *testing.T) {
+dir := t.TempDir()
+
+// Write initial secret files
+writeSecret(t, dir, "embeddings-url", "http://old-embed:8000")
+writeSecret(t, dir, "llm-url", "http://old-llm:9000")
+
+s := Load()
+s.SecretsPath = dir
+s.reloadFromSecrets()
+
+if s.EmbeddingsURL() != "http://old-embed:8000" {
+t.Errorf("expected reloaded EmbeddingsURL, got %q", s.EmbeddingsURL())
+}
+if s.LLMURL() != "http://old-llm:9000" {
+t.Errorf("expected reloaded LLMURL, got %q", s.LLMURL())
+}
+
+// Simulate secret update
+writeSecret(t, dir, "embeddings-url", "http://new-embed:8000")
+s.reloadFromSecrets()
+
+if s.EmbeddingsURL() != "http://new-embed:8000" {
+t.Errorf("expected updated EmbeddingsURL, got %q", s.EmbeddingsURL())
+}
+// LLM should remain unchanged
+if s.LLMURL() != "http://old-llm:9000" {
+t.Errorf("expected unchanged LLMURL, got %q", s.LLMURL())
+}
+}
+
+func TestReloadFromSecretsNoPath(t *testing.T) {
+s := Load()
+s.SecretsPath = ""
+// Should not panic
+s.reloadFromSecrets()
+}
+
+func TestGetEnvDuration(t *testing.T) {
+t.Setenv("TEST_DUR", "30")
+d := getEnvDuration("TEST_DUR", 10*time.Second)
+if d != 30*time.Second {
+t.Errorf("expected 30s, got %v", d)
+}
+}
+
+func writeSecret(t *testing.T, dir, name, value string) {
+t.Helper()
+if err := os.WriteFile(filepath.Join(dir, name), []byte(value), 0644); err != nil {
+t.Fatal(err)
+}
 }