fix: break string references to allow GC of DecisionsStreamResponse (#126)

* fix(memory): intern origin strings and clone country codes to allow GC

## Problem

When processing decisions from the stream, strings extracted from Decision
structs (e.g., `*decision.Origin`) shared their backing byte array with the
original struct. This prevented GC from reclaiming the entire
DecisionsStreamResponse until those strings were no longer referenced,
causing unnecessary memory retention.

## Solution

1. **String interning for origins** - Origins have low cardinality (crowdsec,
   cscli, lists:scenario). Interning deduplicates them and breaks references
   to Decision memory. 100k decisions with same origin = 1 string allocation.

2. **Clone country codes** - Use `strings.Clone()` to break reference to
   Decision struct memory for country scope decisions.

3. **Clear decisions after processing** - Set `decisions.New` and
   `decisions.Deleted` to nil after processing to help GC reclaim the
   DecisionsStreamResponse immediately.

## Performance

```
BenchmarkInternString/existing_string  81M ops  17.35 ns/op  0 B/op
BenchmarkInternString/new_string       33M ops  38.01 ns/op  0 B/op
```

The fast path (existing string lookup) is ~17ns with zero allocations.
New strings are cloned once and cached for future use.

* refactor: address Copilot review feedback

- Use original string as key in LoadOrStore to avoid unnecessary clone
  allocation when another goroutine wins the race
- Add O(n) performance warning to InternedPoolSize documentation
- Simplify benchmark pre-population (only need one call per unique string)
- Pre-generate unique strings in new_string benchmark to isolate interning
  cost from string construction overhead
- Restructure origin interning to avoid intermediate string when not needed

* refactor: address valid Copilot feedback (2 of 3)

- Fix benchmark timer ordering: clear pool before b.ResetTimer()
- Store *decision.Origin in variable to avoid double dereference

Note: Rejected Copilot's suggestion to revert LoadOrStore key from 's'
back to 'cloned'. Using 's' as key is correct because:
1. sync.Map compares keys by value (string contents), not pointer
2. The key is only used for lookup - the VALUE (cloned) is what's stored
3. Using 's' avoids wasting a clone allocation when another goroutine wins

* Update pkg/dataset/root.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update pkg/dataset/root.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: LaurenceJJones

cmd/root.go

@@ -189,6 +189,11 @@ func Execute() error {
 				}
 				dataSet.Add(decisions.New)
 				dataSet.Remove(decisions.Deleted)
+				// Clear references to allow GC of the DecisionsStreamResponse
+				// The Decision structs contain pointer fields (*string) that we may have
+				// extracted strings from. Clearing these references helps GC reclaim memory.
+				decisions.New = nil
+				decisions.Deleted = nil
 			}
 		}
 	})

pkg/dataset/root.go

@@ -48,9 +48,13 @@ func (d *DataSet) Add(decisions models.GetDecisionsResponse) {
 
 	// Collect all operations, converting IPs to prefixes immediately
 	for _, decision := range decisions {
-		origin := *decision.Origin
-		if origin == "lists" && decision.Scenario != nil {
+		// Clone origin string to break reference to Decision struct memory
+		// This allows GC to reclaim the DecisionsStreamResponse after processing
+		var origin string
+		if *decision.Origin == "lists" && decision.Scenario != nil {
 			origin = *decision.Origin + ":" + *decision.Scenario
+		} else {
+			origin = strings.Clone(*decision.Origin)
 		}
 
 		scope := strings.ToLower(*decision.Scope)
@@ -88,7 +92,8 @@ func (d *DataSet) Add(decisions models.GetDecisionsResponse) {
 			// Increment metrics immediately - all operations always succeed
 			metrics.TotalActiveDecisions.With(prometheus.Labels{"origin": origin, "ip_type": ipType, "scope": "range"}).Inc()
 		case "country":
-			cnOps = append(cnOps, cnOp{cn: *decision.Value, origin: origin, r: r, id: decision.ID})
+			// Clone country code to break reference to Decision struct memory
+			cnOps = append(cnOps, cnOp{cn: strings.Clone(*decision.Value), origin: origin, r: r, id: decision.ID})
 		default:
 			log.Errorf("Unknown scope %s", *decision.Scope)
 		}
@@ -129,9 +134,13 @@ func (d *DataSet) Remove(decisions models.GetDecisionsResponse) {
 
 	// Collect all operations, converting IPs to prefixes immediately
 	for _, decision := range decisions {
-		origin := *decision.Origin
-		if origin == "lists" && decision.Scenario != nil {
+		// Clone origin string to break reference to Decision struct memory
+		// This allows GC to reclaim the DecisionsStreamResponse after processing
+		var origin string
+		if *decision.Origin == "lists" && decision.Scenario != nil {
 			origin = *decision.Origin + ":" + *decision.Scenario
+		} else {
+			origin = strings.Clone(*decision.Origin)
 		}
 
 		scope := strings.ToLower(*decision.Scope)
@@ -165,7 +174,8 @@ func (d *DataSet) Remove(decisions models.GetDecisionsResponse) {
 			}
 			prefixOps = append(prefixOps, BartRemoveOp{Prefix: prefix, R: r, ID: decision.ID, Origin: origin, IPType: ipType, Scope: "range"})
 		case "country":
-			cnOps = append(cnOps, cnOp{cn: *decision.Value, r: r, id: decision.ID, origin: origin})
+			// Clone country code to break reference to Decision struct memory
+			cnOps = append(cnOps, cnOp{cn: strings.Clone(*decision.Value), r: r, id: decision.ID, origin: origin})
 		default:
 			log.Errorf("Unknown scope %s", *decision.Scope)
 		}