fix(timing): escape double quotes and backslashes in Server-Timing descriptions - #5478

The author should do the following, if applicable

• Add tests
• Run tests
• pnpm run check:fix to format and lint the code
• Add TSDoc/JSDoc to document the code

Description

In src/middleware/timing/timing.ts, metric descriptions (description and valueDescription) were interpolated into desc="..." without escaping quotes or backslashes.

When descriptions contain double quotes (e.g. setMetric(c, 'db', 12.3, 'Query "users"')), the resulting header has invalid syntax:

Server-Timing: db;dur=12.3;desc="Query "users""

According to RFC 9110 Section 5.6.4 and W3C Server Timing Section 2.1, desc is serialized as a quoted-string; inner " and \ characters must be backslash-escaped.

This change escapes backslashes and double quotes in description and valueDescription:

const metric = description
  ? `${name};dur=${dur};desc="${description.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`
  : `${name};dur=${dur}`

This fixes quoted-string escaping per RFC 9110 and matches the quote-escaping approach in Hono's bearer-auth middleware.

Test Plan

Added unit tests in src/middleware/timing/index.test.ts verifying expected header outputs:

• Numeric metric description: 'db;dur=12.3;desc="Query \\"users\\""'
• Value-less metric description: 'cache;desc="hit \\"fast\\""'
• Description with backslashes: 'fs;dur=5.0;desc="path\\\\to\\\\\\"file\\""'
• Custom totalDescription: 'desc="Total \\"App\\" Time"'

Verification:

• pnpm exec vitest run src/middleware/timing (20/20 passed)
• pnpm run check:fix (clean)

Disclosure: Implemented with AI assistance under human review.