Add API benchmark harness

[kekehanshujun]

/claim #30

Summary

• Adds npm run benchmark and npm run benchmark:smoke from the repository root.
• Implements a zero-dependency Node benchmark runner under benchmarks/ that starts the API locally or targets BENCHMARK_BASE_URL.
• Covers every existing /api/ route with realistic GET, JSON POST, multipart upload, and admin-auth requests.
• Reports p50/p95/p99 latency, RPS, error rate, and TTFB to JSON and Markdown files under benchmarks/results.
• Adds .env.benchmark.example, configurable threshold gates, and a GitHub Actions smoke benchmark workflow.
• Lets local benchmark runs bypass loopback rate limiting with BENCHMARK_DISABLE_RATE_LIMIT=true so route metrics are not dominated by 429s.

Validation

• npm test
• npm run benchmark:smoke
• npm run benchmark

Full benchmark completed locally with 20 endpoints, 600 samples, and 0 aggregate errors after rate-limit bypass for the local benchmark target.

[BossChaos]

Code Review

PR: Add API benchmark harness by @kekehanshujun

• ✅ Performance benchmark suite

Wallet: 0xdaE5d307339074A24F579dB48e7c639359D94904

Code review for SecureBananaLabs bug-bounty