audit: API integration audit — endpoint tests, mock data map, broken integrations

[TheDEV111]

Summary

Closes #164

• Tested all API endpoints live against https://nexafx-backend.onrender.com/v1 via HTTP probes (static code audit + live curl)
• Documented every section still serving mock/hardcoded data to users
• Identified broken integrations with root causes
• Produced API_AUDIT.md at the project root with a complete findings table and ordered remediation steps

Key Findings

Backend bugs discovered during live testing

• GET /currencies → 500 Internal Server Error regardless of auth (breaks withdrawal currency dropdown and convert form for all users)
• GET /exchange-rates → 500 Internal Server Error regardless of auth (breaks MarketOverview rate cards and convert form rate display)
• POST /auth/refresh with empty body → 500 instead of 400 (minor robustness gap)

Broken integrations confirmed

• GET /wallets/balances → 404 (wrong path — correct path is /users/wallet/balances, confirmed live)
• POST /transactions/convert → 404 (wrong route name — correct backend route is /transactions/swap)
• GET /push-notifications → 404 (wrong path — correct path is /admin/push-notifications)
• AccountOverview shows hardcoded fake balances to every authenticated user (getBalances() API exists but is not called)
• user.name is always undefined after login (backend returns firstName/lastName, frontend expects name)
• Hardcoded 80 USD in every transaction table row regardless of actual transaction data

Mock data inventory (not fixed in this PR — audit only)

• All admin panel pages (analytics, users, transactions, push-notifications) use lib/admin-mock-data.ts
• Convert form uses inline MOCK_RATES and MOCK_BALANCES constants; submit button is permanently disabled={true}
• Three orphaned mock files (app/lib/api/transactions.ts, lib/mock-notifications.ts, lib/mock-data.ts) are not imported anywhere and can be deleted

Security note

• app/api/proxy/[...path]/route.ts falls back to TEST_ACCESS_TOKEN env var when no client token is present — if set in staging/production, unauthenticated users would receive data belonging to the dev token owner. Documented in the audit.

[drips-wave]

@TheDEV111 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[TheDEV111]

@portableDD