fix: Resolve memory exhaustion with Twig-based plugins (v0.4.1)

- Add early metrics endpoint handler to intercept /metrics before full WP init
- Remove content filters during metrics collection to prevent recursion
- Skip extensibility hooks in early metrics mode
- Change template_redirect to parse_request for earlier interception

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

wp-prometheus.php

@@ -3,7 +3,7 @@
  * Plugin Name: WP Prometheus
  * Plugin URI: https://src.bundespruefstelle.ch/magdev/wp-prometheus
  * Description: Prometheus metrics endpoint for WordPress with extensible hooks for custom metrics.
- * Version: 0.4.0
+ * Version: 0.4.1
  * Requires at least: 6.4
  * Requires PHP: 8.3
  * Author: Marco Graetsch
@@ -21,12 +21,104 @@ if ( ! defined( 'ABSPATH' ) ) {
     exit;
 }
 
+/**
+ * Early metrics endpoint handler.
+ *
+ * Intercepts /metrics requests before full WordPress initialization to avoid
+ * conflicts with other plugins that may cause issues during template loading.
+ * This runs at plugin load time, before plugins_loaded hook.
+ */
+function wp_prometheus_early_metrics_check(): void {
+    // Only handle /metrics requests.
+    $request_uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
+    $path        = wp_parse_url( $request_uri, PHP_URL_PATH );
+
+    if ( ! preg_match( '#/metrics/?$#', $path ) ) {
+        return;
+    }
+
+    // Check if autoloader exists.
+    $autoloader = __DIR__ . '/vendor/autoload.php';
+    if ( ! file_exists( $autoloader ) ) {
+        return;
+    }
+
+    require_once $autoloader;
+
+    // Check license validity.
+    if ( ! \Magdev\WpPrometheus\License\Manager::is_license_valid() ) {
+        return; // Let normal flow handle unlicensed state.
+    }
+
+    // Authenticate.
+    $auth_token = get_option( 'wp_prometheus_auth_token', '' );
+    if ( empty( $auth_token ) ) {
+        status_header( 401 );
+        header( 'WWW-Authenticate: Bearer realm="WP Prometheus Metrics"' );
+        header( 'Content-Type: text/plain; charset=utf-8' );
+        echo 'Unauthorized';
+        exit;
+    }
+
+    // Check Bearer token.
+    $auth_header = '';
+    if ( isset( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
+        $auth_header = sanitize_text_field( wp_unslash( $_SERVER['HTTP_AUTHORIZATION'] ) );
+    } elseif ( isset( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) ) {
+        $auth_header = sanitize_text_field( wp_unslash( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) );
+    }
+
+    $authenticated = false;
+    if ( ! empty( $auth_header ) && preg_match( '/Bearer\s+(.*)$/i', $auth_header, $matches ) ) {
+        $authenticated = hash_equals( $auth_token, $matches[1] );
+    }
+
+    // Check query parameter fallback.
+    // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Auth token check.
+    if ( ! $authenticated && isset( $_GET['token'] ) ) {
+        $authenticated = hash_equals( $auth_token, sanitize_text_field( wp_unslash( $_GET['token'] ) ) );
+    }
+
+    if ( ! $authenticated ) {
+        status_header( 401 );
+        header( 'WWW-Authenticate: Bearer realm="WP Prometheus Metrics"' );
+        header( 'Content-Type: text/plain; charset=utf-8' );
+        echo 'Unauthorized';
+        exit;
+    }
+
+    // Set flag to indicate early metrics mode - Collector will skip extensibility hooks.
+    define( 'WP_PROMETHEUS_EARLY_METRICS', true );
+
+    // Remove all content filters to prevent recursion with Twig-based plugins.
+    remove_all_filters( 'the_content' );
+    remove_all_filters( 'the_excerpt' );
+    remove_all_filters( 'get_the_excerpt' );
+    remove_all_filters( 'the_title' );
+
+    // Output metrics and exit immediately.
+    $collector = new \Magdev\WpPrometheus\Metrics\Collector();
+
+    status_header( 200 );
+    header( 'Content-Type: text/plain; version=0.0.4; charset=utf-8' );
+    header( 'Cache-Control: no-cache, no-store, must-revalidate' );
+    header( 'Pragma: no-cache' );
+    header( 'Expires: 0' );
+
+    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Prometheus format.
+    echo $collector->render();
+    exit;
+}
+
+// Try early metrics handling before full plugin initialization.
+wp_prometheus_early_metrics_check();
+
 /**
  * Plugin version.
  *
  * @var string
  */
-define( 'WP_PROMETHEUS_VERSION', '0.4.0' );
+define( 'WP_PROMETHEUS_VERSION', '0.4.1' );
 
 /**
  * Plugin file path.