[Frontend][Bug] Test-enrollment harness shipped as a production route; can post fake payment data

[Penielka]

Overview

frontend/src/app/test-enrollment/page.tsx is a full test harness mounted as a real route (/test-enrollment) in the Next.js app router — it ships to production. The page posts mock payment payloads to /api/enroll with recipientAddress: 'TEST_RECIPIENT_ADDRESS', transactionHash: 'TEST_TX_HASH_12345' and status: 'completed'. Anyone who visits the route can insert fake enrollments/payments into the backend database.

Evidence

• frontend/src/app/test-enrollment/page.tsx — POST body with fake payment details

Acceptance Criteria

• Remove the route from the production build (or gate it behind an env flag)
• Add a backend-side validation that rejects obviously fake transaction hashes
• Verify no production enrollments were created by this page

Files to Modify

• frontend/src/app/test-enrollment/page.tsx

Priority: High

[ReinaMaze]

GM Maintainer, Can I get assigned to work on this?
I’ll remove the /test-enrollment test harness from the production build or gate it behind an explicit environment flag, so mock payment data cannot be submitted through a publicly accessible route
I’ll also add backend-side validation to reject obviously fake transaction hashes, verify the enrollment flow still works correctly, and confirm the test route cannot create production enrollments.

ETA: 48 hours