Wire OpenTelemetry tracing — HTTP, B2, APNs, FCM, asynq, GORM (partial)

Step 1 — OTel SDK: cmd/api and cmd/worker initialize a tracer provider
that exports OTLP/HTTP to obs.88oakapps.com (Jaeger all-in-one). Sampling
is AlwaysSample in dev (DEBUG=true) and TraceIDRatioBased(0.1) in prod,
overridable via OTEL_TRACES_SAMPLER_ARG. Service names are honeydue-api
and honeydue-worker. otelecho.Middleware opens a span per HTTP request.

Step 2 — Manual spans: storage_service.Upload now takes ctx and emits
storage.upload + b2.PutObject spans (size_bytes, key, mime_type, bucket,
result attrs). APNs Send/SendWithCategory and FCM sendOne emit per-token
spans with topic, status_code, reason. Asynq middleware emits
asynq.handle:<task_type> per job with retry/payload attrs and records
asynq_job_duration_seconds.

Step 3 — Database: otelgorm plugin registered in database.Connect, so
any SQL emitted via db.WithContext(ctx) attaches to the request span.
Every repository now exposes WithContext(ctx) *XRepository as the
migration helper. TaskService.ListTasks and GetTasksByResidence are
migrated end-to-end (ctx threaded through handler → service → repo);
remaining services adopt the same pattern incrementally — pre-migration
methods still emit untraced SQL via the unchanged db field.

OBS_TRACES_URL and OBS_INGEST_TOKEN flow from deploy/prod.env →
honeydue-secrets → api+worker Deployments via secretKeyRef (optional).
02-setup-secrets.sh sources them from prod.env on next run; manifests
mark both env vars optional so the deployment rolls without traces if
the secret is absent.

ch15 observability doc now lists what produces spans today vs the
remaining migration work, with the explicit per-method pattern.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/services/storage_service.go

@@ -1,6 +1,7 @@
 package services
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"mime/multipart"
@@ -14,8 +15,14 @@ import (
 
 	"github.com/treytartt/honeydue-api/internal/config"
 	"github.com/treytartt/honeydue-api/internal/prom"
+	"github.com/treytartt/honeydue-api/internal/tracing"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	"go.opentelemetry.io/otel/trace"
 )
 
+var storageTracer = tracing.Tracer("honeydue/services/storage")
+
 // StorageService handles file uploads, validation, encryption, and URL generation.
 // It delegates raw I/O to a StorageBackend (local filesystem or S3-compatible).
 type StorageService struct {
@@ -66,8 +73,17 @@ func NewStorageService(cfg *config.StorageConfig) (*StorageService, error) {
 	return &StorageService{cfg: cfg, backend: backend, allowedTypes: allowedTypes}, nil
 }
 
-// Upload saves a file to storage (local or S3)
-func (s *StorageService) Upload(file *multipart.FileHeader, category string) (*UploadResult, error) {
+// Upload saves a file to storage (local or S3). The ctx is used to attach
+// the underlying B2/S3 PutObject span to the request trace.
+func (s *StorageService) Upload(ctx context.Context, file *multipart.FileHeader, category string) (*UploadResult, error) {
+	ctx, span := storageTracer.Start(ctx, "storage.upload",
+		trace.WithAttributes(
+			attribute.String("file.name", file.Filename),
+			attribute.Int64("file.size_bytes", file.Size),
+			attribute.String("upload.category", category),
+		),
+	)
+	defer span.End()
 	// Validate file size
 	if file.Size > s.cfg.MaxFileSize {
 		return nil, fmt.Errorf("file size %d exceeds maximum allowed %d bytes", file.Size, s.cfg.MaxFileSize)
@@ -150,18 +166,31 @@ func (s *StorageService) Upload(file *multipart.FileHeader, category string) (*U
 		}
 	}
 
-	// Write to backend (B2/S3 round trip — instrumented for Prometheus)
+	// Write to backend (B2/S3 round trip — instrumented for Prometheus + traces)
 	bucket := s.cfg.S3Bucket
 	if bucket == "" {
 		bucket = "local"
 	}
+	_, putSpan := storageTracer.Start(ctx, "b2.PutObject",
+		trace.WithAttributes(
+			attribute.String("b2.bucket", bucket),
+			attribute.String("b2.key", key),
+			attribute.Int64("b2.size_bytes", int64(len(fileData))),
+			attribute.String("b2.mime_type", mimeType),
+		),
+	)
 	uploadStart := time.Now()
 	if err := s.backend.Write(key, fileData); err != nil {
 		prom.ObserveB2Upload(bucket, "error", time.Since(uploadStart), 0)
+		putSpan.SetStatus(codes.Error, "write failed")
+		putSpan.RecordError(err)
+		putSpan.End()
 		return nil, fmt.Errorf("failed to save file: %w", err)
 	}
 	written := int64(len(fileData))
 	prom.ObserveB2Upload(bucket, "ok", time.Since(uploadStart), written)
+	putSpan.SetAttributes(attribute.Int64("b2.bytes_written", written))
+	putSpan.End()
 
 	// Generate URL (always uses the original filename without .enc suffix)
 	url := fmt.Sprintf("%s/%s/%s", s.cfg.BaseURL, subdir, newFilename)