Add API benchmark suite

[JackSpiece]

/claim #30

Summary

• Added a dependency-free Node benchmark runner under benchmarks/.
• Covered all 20 Express routes mounted under /api/, including the protected admin metrics route with a dedicated benchmark admin token.
• Added npm run benchmark, a .env.benchmark template, threshold config, and committed latest JSON plus markdown results.
• Added a pull request smoke workflow that runs the benchmark gate and fails on p99 latency or error-rate threshold breaches.
• Fixed the API test script so npm test runs the actual *.test.js files.

Benchmark Environment

Hardware

• CPU model and core count: unknown model, 8 cores
• RAM: 7174 MB total, 1431 MB free during the recorded full run
• Storage type: unknown
• Network interface: loopback
• Machine type: local workstation
• OS and version: Linux 5.10.101-android12-9-g2e7a07f6ccaf-ab14.0.772_230301 arm64

Runtime

• Node.js version: v24.13.0
• Resource limits: none configured
• Other significant processes running during benchmark: not measured

If submitted by or with an AI agent

• Agent or tool name: Codex CLI
• Underlying model and version: GPT-5.5 xhigh
• Inference provider: OpenAI
• Orchestration framework: Codex CLI
• Execution mode: human-supervised
• Shell/tool access during execution: yes
• Internet access during execution: yes
• Benchmark commands run by agent directly: yes
• Known constraints or sandboxing: Termux on Android, loopback local API benchmark

Benchmark Summary

API Benchmark Summary

• Mode: full
• Target: local Express app on loopback
• Duration per endpoint: 1000 ms
• Concurrency: 4
• Max requests per endpoint: 8
• Total requests: 160
• Max p99 latency: 21.06 ms
• Max error rate: 0%

Endpoint	Requests	p50 ms	p95 ms	p99 ms	TTFB p95 ms	Sustained RPS	Peak RPS	Error rate
POST /api/auth/register	8	6.37	21.06	21.06	20.86	322.91	8	0%
POST /api/auth/login	8	5.29	6.35	6.35	6.21	760.1	8	0%
GET /api/auth/oauth/github/callback	8	3.96	5.27	5.27	5.17	886.37	8	0%
POST /api/auth/refresh	8	5.64	7.19	7.19	7.02	588.78	8	0%
GET /api/users	8	4.19	5.54	5.54	5.44	792.65	8	0%
POST /api/users	8	4.54	5.54	5.54	5.41	773.93	8	0%
GET /api/jobs	8	3.72	4.61	4.61	4.52	904.47	8	0%
POST /api/jobs	8	4.43	5.58	5.58	5.45	761.89	8	0%
GET /api/proposals	8	3.85	5.5	5.5	5.4	799.97	8	0%
POST /api/proposals	8	4.62	5.78	5.78	5.66	730.13	8	0%
POST /api/payments	8	3.76	5.26	5.26	5.13	838.08	8	0%
GET /api/reviews	8	3.93	4.81	4.81	4.63	830.52	8	0%
POST /api/reviews	8	4.75	5.67	5.67	5.55	727.51	8	0%
GET /api/messages	8	3.84	4.74	4.74	4.65	845.93	8	0%
POST /api/messages	8	4.78	6.27	6.27	6.15	697.66	8	0%
GET /api/notifications	8	3.59	4.42	4.42	4.33	947.83	8	0%
POST /api/notifications	8	4.4	5.16	5.16	5.05	812.44	8	0%
POST /api/uploads	8	6.23	12.75	12.75	12.62	350.94	8	0%
GET /api/search?q=dashboard	8	3.78	5.07	5.07	4.97	860.08	8	0%
GET /api/admin/metrics	8	3.96	5.23	5.23	5.13	867	8	0%

Testing

• npm ci
• npm test
• npm run benchmark -- --smoke
• npm run benchmark
• node --check benchmarks/run-benchmark.mjs
• git diff --check