feat(bench): JMH microbenchmarks module + manual CI job

CEO plan v1 polish — закрывает gap "JMH performance benchmarks в CI для
baseline + Redis-enabled scenarios".

New module:
- ordinis-bench/ — JMH 1.37 microbenchmarks. Gated behind `bench` Maven
  profile в parent pom — НЕ строится при обычном `mvn package` (default
  CI остаётся быстрым).
- maven-shade-plugin под `bench` profile собирает uber-jar
  `target/benchmarks.jar` (86 MB, ~12 sec build).
- LineageBenchmark covers hot paths из dict-relationships-v2:
  * parseRef_simple / withSchemaButNoOnClose / withOnClose
  * onCloseAction_block / cascade / null
  * schemaTraversal_findRefs (40 props, 5 refs — realistic shape)

Baseline numbers (M3 MBP, JDK 25, single thread):
- onCloseAction_*: 0.6–12 ns/op
- parseRef_*: 20–93 ns/op
- schemaTraversal: 417 ns/op (~83 ns per ref на 40 props)
Cumulative budget for findSchemaDependents на 40 dicts × 40 props × 5 refs:
~17 µs. p99 endpoint SLO = 200 ms — запас 4 порядка. README documents
budget + 2x regression alarm.

CI integration:
- New job maven-bench (stage: test). Manual trigger only:
  * RUN_BENCH=true variable, OR
  * web pipeline source с manual click.
- Default CI (push/merge) НЕ запускает bench — slow + noisy в history.
- Output artifacts: bench-results.json + bench-results.txt (5 day expire).
- Quick smoke config: 1 fork, 2 warmups, 3 measurements × 2s = ~5 min total.

Side effect: ReferenceValidator.parseRef static methods переведены из
package-private в public. Они и так часть public ParsedRef contract —
visible to bench module без изменения design intent.

Verify:
- mvn -P bench -pl ordinis-bench -am package: BUILD SUCCESS (12s).
- java -jar benchmarks.jar -f 1 -wi 1 -i 2 Lineage: all 7 benchmarks
  exec'ятся, valid ns/op numbers.
- mvn -pl ordinis-rest-api -am test: 106/106 PASS unchanged.
- glab ci lint: clean.

README в ordinis-bench/README.md документирует:
- baseline numbers + 2x regression budget
- local run options (smoke / full / GC profile / JSON output)
- when CI bench runs (manual web trigger)
- difference vs k6/wrk (HTTP load tests are different layer, both needed)
- how to add new benchmark

.gitlab-ci.yml

@@ -102,6 +102,31 @@ maven-e2e:
     - changes: *backend-changes
   # Можно сделать allow_failure: true если e2e будут флакать — пока нет.
 
+# ─── BENCH (manual JMH) ────────────────────────
+# Manual trigger only — slow (~5-10 min) + noisy в CI history. Trigger через
+# pipeline run UI с variable RUN_BENCH=true. Catches алгоритмическую регрессию
+# на hot paths (parseRef, OnCloseAction, schema traversal).
+maven-bench:
+  stage: test
+  image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
+  script:
+    - mvn $MAVEN_CLI_OPTS -P bench -pl ordinis-bench -am package -DskipTests
+    # Quick smoke: 1 fork, 2 warmups, 3 measurements × 2s. Total ~5 min.
+    # Если нужно надёжнее — bump до -f 2 -wi 5 -i 5 -r 5 (15 min).
+    - java -jar ordinis-bench/target/benchmarks.jar -f 1 -wi 2 -i 3 -w 1 -r 2
+        -rf json -rff bench-results.json | tee bench-results.txt
+  artifacts:
+    paths:
+      - bench-results.json
+      - bench-results.txt
+    expire_in: 5 days
+  rules:
+    - if: '$RUN_BENCH == "true"'
+      when: on_success
+    - if: '$CI_PIPELINE_SOURCE == "web"'
+      when: manual
+      allow_failure: true
+
 # ─── BUILD (Maven jars) ────────────────────────
 # maven-package всегда запускается: docker backend jobs нуждаются в jar даже
 # при frontend-only PR (иначе backend образы не пересобрать → ImagePullBackOff