perf(client): pool *bytes.Buffer for response body reads

Replace io.ReadAll(resp.Body) on the typed Call/callMultipart paths with a sync.Pool-backed bytes.Buffer + ReadFrom. Saves the 512B initial allocation that ReadAll grows from on every successful call.

The pool only covers paths whose decoder copies strings out of the input (decodeResult delegates to goccy/go-json, which copies). CallRaw and callMultipartRaw return slices that alias the buffer storage, so they keep the io.ReadAll path; pooling there would need a defensive copy that defeats the saving.

putRespBuf caps Cap() at 64 KiB before returning to the pool so a single oversized response (e.g. large getFile metadata) doesn't bloat the pool for the rest of the process.

Bench delta on Call_BoolResponse: 14 allocs -> 13 allocs, 1842B -> 1331B, 526ns -> 479ns. Same shape on Call_StructResponse (16 -> 15, 1973B -> 1462B).

client/call.go

@@ -8,14 +8,36 @@ import (
 	"io"
 	"net/http"
 	"reflect"
+	"sync"
 )
 
 var (
 	headerJSONValue = []string{"application/json"}
 	rawOKTrueBody   = []byte(`{"ok":true,"result":true}`)
 	rawOKFalseBody  = []byte(`{"ok":true,"result":false}`)
+
+	// respBufPool reuses *bytes.Buffer for response body reads. Used on
+	// paths whose decoder copies strings out of the input (decodeResult,
+	// which delegates to goccy/go-json), so the buffer can be returned to
+	// the pool as soon as Unmarshal has run. CallRaw and callMultipartRaw
+	// return slices that alias the buffer and therefore cannot use the
+	// pool without an extra copy that would defeat the point.
+	respBufPool = sync.Pool{New: func() any { return new(bytes.Buffer) }}
 )
 
+// maxPooledBufCap caps the buffer size returned to respBufPool. Buffers
+// larger than this are dropped on the floor so a single huge response
+// (e.g. a large getFile metadata payload) doesn't bloat the pool for the
+// rest of the process lifetime.
+const maxPooledBufCap = 64 * 1024
+
+func putRespBuf(buf *bytes.Buffer) {
+	if buf.Cap() > maxPooledBufCap {
+		return
+	}
+	respBufPool.Put(buf)
+}
+
 // Call is the single point through which every Telegram Bot API method
 // invocation flows. It marshals the request, signs the URL with the bot
 // token, dispatches via HTTPDoer, decodes the Result envelope, and
@@ -63,12 +85,14 @@ func Call[Req any, Resp any](ctx context.Context, b *Bot, method string, req Req
 	}
 	defer func() { _ = resp.Body.Close() }()
 
-	raw, err := io.ReadAll(resp.Body)
-	if err != nil {
+	buf := respBufPool.Get().(*bytes.Buffer)
+	buf.Reset()
+	defer putRespBuf(buf)
+	if _, err := buf.ReadFrom(resp.Body); err != nil {
 		return zero, &NetworkError{Err: err}
 	}
 
-	return decodeResult[Resp](b.codec, raw)
+	return decodeResult[Resp](b.codec, buf.Bytes())
 }
 
 // CallRaw is like Call but returns the raw JSON of the result field

client/multipart.go

@@ -1,6 +1,7 @@
 package client
 
 import (
+	"bytes"
 	"context"
 	"github.com/goccy/go-json"
 	"io"
@@ -81,12 +82,14 @@ func callMultipart[Resp any](ctx context.Context, b *Bot, method string, mp mult
 	}
 	defer func() { _ = resp.Body.Close() }()
 
-	raw, err := io.ReadAll(resp.Body)
-	if err != nil {
+	buf := respBufPool.Get().(*bytes.Buffer)
+	buf.Reset()
+	defer putRespBuf(buf)
+	if _, err := buf.ReadFrom(resp.Body); err != nil {
 		_ = pr.CloseWithError(err)
 		return zero, &NetworkError{Err: err}
 	}
-	return decodeResult[Resp](b.codec, raw)
+	return decodeResult[Resp](b.codec, buf.Bytes())
 }
 
 // callMultipartRaw is callMultipart's sibling that returns the raw result