feat: add API benchmark suite

[devnull37]

/claim #30

Summary

• add an autocannon-based benchmark suite under /benchmarks
• cover all 20 current /api/* routes with realistic synthetic payloads and benchmark admin auth
• write JSON and Markdown reports into /benchmarks/results/
• add reviewable p99/error-rate thresholds and a CI smoke workflow
• document .env.benchmark setup and smoke/full benchmark modes

Verification

ode --check benchmarks/run-benchmark.mjs

ode --check benchmarks/endpoints.mjs

pm run test -w apps/api

pm run benchmark:smoke

Smoke Benchmark Summary

Target: http://127.0.0.1:4000
Mode: smoke
Duration per endpoint: 2s
Connections: 1
Endpoints covered: 20
Result: all endpoints passed thresholds, 0% error rate.

Benchmark Environment

Hardware

• CPU model & core count: Intel(R) Core(TM) i3-N305; 8 logical cores
• RAM (total & available during benchmark): 8 GB total
• Storage type (SSD / NVMe / HDD): local workstation storage
• Network interface (Ethernet / WiFi / loopback): loopback
• Machine type: local workstation
• OS & version: Windows_NT 10.0.26200 x64

Runtime

• Node.js version: v24.15.0
• Any resource limits applied: none intentionally applied
• Other significant processes running during benchmark: normal desktop/Codex processes

If submitted by or with an AI agent

• Agent or tool name: OpenAI Codex
• Underlying model and version: GPT-5-family Codex model
• Inference provider: OpenAI
• Orchestration framework if any: Codex subagents for parallel bounty work
• Execution mode: human-initiated, agent-executed
• Did the agent have shell/tool access during execution: yes
• Did the agent have internet access during execution: yes
• Were benchmark commands run by the agent directly or handed off to the human to run: run directly by the agent
• Any known agent constraints or sandboxing that may have affected execution: local Codex desktop environment with rtk-wrapped shell commands