Add API benchmark suite

.github/workflows/benchmark-smoke.yml

@@ -0,0 +1,27 @@
+name: Benchmark smoke
+
+on:
+  pull_request:
+    paths:
+      - "apps/api/**"
+      - "benchmarks/**"
+      - "package.json"
+      - "package-lock.json"
+      - ".github/workflows/benchmark-smoke.yml"
+  workflow_dispatch:
+
+jobs:
+  benchmark-smoke:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - run: npm ci
+
+      - run: npm run benchmark:smoke

apps/api/package.json

@@ -5,7 +5,7 @@
   "scripts": {
     "dev": "node src/server.js",
     "start": "node src/server.js",
-    "test": "node --test src/tests"
+    "test": "node --test src/tests/*.test.js"
   },
   "dependencies": {
     "cors": "^2.8.5",

benchmarks/.env.benchmark.example

@@ -0,0 +1,10 @@
+# Optional. If omitted, the benchmark runner starts the local Express app on an ephemeral port.
+BENCHMARK_TARGET_URL=http://127.0.0.1:4000
+
+# Used when the benchmark runner starts the local app and when it requests a benchmark auth token.
+JWT_SECRET=benchmark-secret
+
+# Tuning knobs. Defaults are intentionally small to avoid tripping the API rate limiter.
+BENCHMARK_MODE=full
+BENCHMARK_REQUESTS_PER_ENDPOINT=5
+BENCHMARK_CONCURRENCY=2

benchmarks/README.md

@@ -0,0 +1,52 @@
+# API Benchmarks
+
+This suite benchmarks the current Express API surface with Node's built-in `fetch`.
+
+## Commands
+
+```bash
+npm run benchmark
+npm run benchmark:smoke
+```
+
+By default the runner starts the local API on an ephemeral loopback port. To target an existing local or staging API, copy `benchmarks/.env.benchmark.example` to `benchmarks/.env.benchmark` and set `BENCHMARK_TARGET_URL`.
+
+## Coverage
+
+The route manifest covers `/health` and every mounted `/api/*` route in `apps/api/src/app.js`:
+
+- `POST /api/auth/register`
+- `POST /api/auth/login`
+- `GET /api/auth/oauth/:provider/callback`
+- `POST /api/auth/refresh`
+- `GET /api/users`
+- `POST /api/users`
+- `GET /api/jobs`
+- `POST /api/jobs`
+- `GET /api/proposals`
+- `POST /api/proposals`
+- `POST /api/payments`
+- `GET /api/reviews`
+- `POST /api/reviews`
+- `GET /api/messages`
+- `POST /api/messages`
+- `GET /api/notifications`
+- `POST /api/notifications`
+- `POST /api/uploads`
+- `GET /api/search`
+- `GET /api/admin/metrics`
+
+The protected admin route uses a benchmark token obtained from the local auth endpoint before the route suite starts.
+
+## Output
+
+Each run writes:
+
+- `benchmarks/results/benchmark-<mode>.json`
+- `benchmarks/results/benchmark-<mode>.md`
+
+The JSON contains p50, p95, p99, sustained RPS, peak RPS, error rate, and TTFB metrics per endpoint. The Markdown report is intended for PR summaries.
+
+## Regression Gate
+
+`npm run benchmark:smoke` reads `benchmarks/thresholds.json` and exits non-zero if any endpoint exceeds its p99 latency threshold or error-rate threshold.