Restore araara opam builds and echo benchmark support

[gdiazlo]

Description

Draft for further review. Restore araara and araara-standard after the missing-package failure in #1288, and add the HTTPS echo workload introduced in #1382 (now 8gbit).

Both standalone images install published HCS 0.18.0, simdjsont 0.5.0 and Repodb 0.9.0 through opam, using standard OCaml 5.4 on Debian 12 and Dune’s release profile. The old hcs.0.16.1 pin is absent from the public araara opam repository; earlier local builds compiled a checkout and did not exercise that package lookup.

Docker builds explicitly set the default opam repository to git+https://github.com/ocaml/opam-repository.git before adding the araara repository and refreshing both indexes.

Each framework directory contains only its Dockerfile, Dune build files, metadata, application source and short README. The application implements the endpoints needed by the 14 profiles in meta.json. Optional regression scripts remain in HCS; legacy CRUD/fortunes/upload endpoints, the custom CLI, and opt-in GC tuning are removed.

Implementation

• Register routes with Hcs.Router and Hcs.Endpoint; use HCS path/query/body APIs and response constructors.
• Serialize JSON per request with simdjsont, araara's documented JSON library, and apply default Plug.Compress middleware.
• Serve files through Hcs.Plug.Static.server with a directory capability rooted at /data/static. The application has no static or serialized response cache.
• Remove redundant Content-Length from the static response: HCS 0.18.0's server adds its own, and HTTP/2 clients reject the duplicate. The adapter leaves file bytes unchanged.
• Implement POST /echo on TLS port 8081 using HCS body and response APIs. It returns status 200, application/octet-stream, and the decoded bytes unchanged, including chunked, empty and binary bodies.
• Use Repodb's typed Query/Expr DSL and Repo.all_query for the price range query, including Query.limit_expr for the bound limit. Repodb owns prepared-statement caching and the shared connection pool; there is no handwritten SQL or alternative database library.
• Offload connection establishment and query execution through Eio_unix.run_in_systhread. Repodb's driver stays synchronous underneath; Eio suspends the requesting fiber while other HTTP requests run. A shared Eio semaphore limits offloaded work and connections to DATABASE_MAX_CONN, so queued requests do not each consume a system thread. An unavailable database returns the required empty JSON result.
• Size HTTP workers with OCaml’s CPU-affinity-aware runtime API, so Docker CPU pinning is respected. Load the TLS certificate pair once and require all four subscribed listeners. The shared application is 292 lines.
• Declare routing, middleware and request completeness; conservatively mark response false because JSON serialization is invoked before Hcs.Response.json. Values are proposed for maintainer review.

Relevant requirements: standard mode, static files, echo, async database, and completeness.

Validation

Against main at 5b111b8889fee61076f1d7dd14fdb3dfd12c8492:

• Both reduced standalone Docker contexts and the HCS-local Dockerfile build through opam, installing HCS 0.18.0, simdjsont 0.5.0 and Repodb 0.9.0.
• Full HttpArena validator: 84 passed, 0 failed per entry.
• Upstream GitHub validation also passed for both entries on commit 5f1f889.
• HCS-local regressions: 36 echo + 74 HTTP/2 checks per entry (220 total), including static file replacement/addition/deletion, JSON escaping and URI decoding. These scripts are not included in this PR.
• 48 additional local database checks: missing/unavailable database, empty range, two concurrent blocked queries on one allocated CPU while HTTP and TLS echo remain responsive, bounded thread usage, total connection budgets across two CPUs, range/limit parameters observed in PostgreSQL, recovery after an initial connection failure without restarting HTTP, and all 32 queued requests completing after the database lock is released.

The remote test host rejects unlimited memlock, so only --ulimit memlock=-1:-1 was removed from a temporary validator copy. No correctness assertions were changed or skipped. Eio used its POSIX fallback. The correctness suites above do not measure official benchmark performance.

[gdiazlo]

I will work on this offline, to avoid noise.