Add HTTP performance log analyzer (M12.6).

Parse rotated nginx JSON access logs into host/route timings so production hotspots can be measured without ad-hoc one-off scripts.

docs/optimization-m12.6-http-performance-analyzer.md

@@ -0,0 +1,49 @@
+# M12.6 — Performance Analyzer Correctness + Rotation-Safe 24h Reporting
+
+Analyzer-only. No nginx, FPM, Redis, or request-path changes.
+
+## Status filters
+
+| Value | Meaning |
+| --- | --- |
+| `--status=404` | **exact** HTTP 404 only |
+| `--status=500` | exact 500 |
+| `--status=4xx` | 400–499 (includes 404, 422, 499) |
+| `--status=5xx` | 500–599 |
+
+`--status=404` is **not** a 4xx class. Malformed values (`foo`, `40`, `9999`) exit 2.
+
+**Bug:** the old analyzer only special-cased `4xx` / `5xx` / `499`. `--status=404` was ignored, so almost every row was returned.
+
+## Inputs
+
+- `--file=path` (repeatable)
+- `--glob='…/skinbase-performance.log*'`
+- default single file remains `/var/log/nginx/skinbase-performance.log`
+- `.gz` streamed with `gzopen` (no `zcat`, no full-file decompress)
+- duplicate **paths** are collapsed via `realpath`; duplicate **events** are kept
+
+## Time / coverage
+
+- `--since=24h` (or `30m` / `7d`) from `--until` or now
+- optional `--until=` ISO-8601, `--hours=24` alias for `--since=24h`
+- Coverage uses parseable timestamps in the supplied files (15-minute tolerance)
+- Incomplete sources emit: `Observed records do not demonstrate full requested coverage.`
+
+## Backward compatible
+
+```bash
+php scripts/analyze-http-performance.php --file=/var/log/nginx/skinbase-performance.log --since=24h --host=skinbase.org
+```
+
+## Rotation-aware 24h
+
+```bash
+sudo php /opt/www/virtual/SkinbaseNova/scripts/analyze-http-performance.php \
+  --glob='/var/log/nginx/skinbase-performance.log*' \
+  --since=24h \
+  --host=skinbase.org \
+  --top=20
+```
+
+`skinbase` may not be able to read `/var/log/nginx`; use the same sudo model as today. The analyzer is read-only.