fix(serializer): make list encoding linear instead of quadratic

[puzza007]

Problem

JSONAPI.Serializer.encode_data/5 for a list builds its result with acc ++ [encoded_data] inside Enum.map_reduce/3, copying the accumulator on every element. Serializing a collection is therefore O(n²) in the number of resources.

This is what is timing out GET /api/save/:id/relationships/assets in CoreGateway for large Edit style trainings (Sentry MAXWELL-7A7T, 3 users since 2026-08-31). For a 77k-asset style the serializer alone took ~25–30s on a laptop — more than the DB query, the Conduit transfer (73MB ETF, 0.3s) and Jason.encode! (1.2s) combined — and prod gateway hosts are slower, so Maxwell's 60s read timeout fires before the first byte is sent.

Fix

Map each element and Enum.unzip/1 the {to_include, encoded} pairs. Same output, same order.

Benchmark (remove_links: true, 5-field view, so this isolates the append):

resources	before	after
10,000	0.15s	0.01s
40,000	2.69s	0.07s
77,011	9.61s	0.17s

Tests

Example test — the existing serialize handles a list serialized three identical items so it could not catch an ordering regression. It now serializes 50 distinct posts and asserts the order of data and of included, plus dedup of a shared comment author.

Property tests (new stream_data test-only dep, test/jsonapi/serializer_property_test.exs) pin the list clause to the single-resource clause for arbitrary lists with nested includes:

• data equals each element serialized on its own, in order
• included equals flatten_included/1 over each element's included
• splitting the list into chunks and concatenating gives the same result

The id space is deliberately small, and users/comments are drawn from fixed pools, so lists routinely contain repeated resources and structurally identical includes and the dedup path is actually exercised. Capped at 25 runs each (suite stays ~1s). The module is sync because the views read process-global Application env that other test modules mutate.

Mutation checks: reversing the list makes all three properties and the example test fail; dropping Enum.uniq/1 from flatten_included/1 fails three example tests.

mix test: 36 doctests, 3 properties, 110 tests, 0 failures. mix credo --strict clean.

Also in this PR

chore(deps): bumps plug and phoenix in the lockfile and removes the orphan earmark dev dep so mix hex.audit (the CI audit job) passes again. No runtime dep changes for consumers; plug stays on the 1.17 line because CI runs Elixir 1.14.

Follow-ups (not in this PR)

• CoreGateway's mix.lock pins jsonapi 1.3.1; the timeout is not fixed there until that pin is bumped after this is released.
• Per-resource cost is still ~55µs, almost all regex dasherize/camelize on every key of every resource. Memoizing the key transformation would take 77k resources from ~5s to well under 1s.
• Two more ++ [x] sites at serializer.ex:122 and :133 are per-resource/per-relationship and not quadratic in the collection size; left alone.

🤖 Generated with Claude Code