feat: resolve #536 #537 #538 #539 — migrate-all, /metrics docs, pkg-dupe CI, rate-limit config

[Good-Coded]

Summary

Resolves four open feature issues in a single cohesive PR. Also fixes pre-existing TypeScript compile errors in main that were blocking tsc --noEmit (those are documented in the commit message and unrelated to the four issues).

---

#539 — Consolidate rate-limit config into one module

Problem: middleware/rateLimit.ts and index.ts each parsed the same RATE_LIMIT_WINDOW_MS / RATE_LIMIT_MAX env vars independently — two diverging sources of truth that could silently drift.

Fix:

• New backend/src/config/rateLimits.ts is the single source of truth for all five rate-limit env vars (RATE_LIMIT_WINDOW_MS, RATE_LIMIT_MAX, WRITE_RATE_LIMIT_MAX, PAYMENTS_RATE_LIMIT_MAX, RATE_LIMIT_MESSAGE)
• Both middleware/rateLimit.ts and index.ts now import from it
• index.ts was also cleaned up: duplicate imports and duplicate route registrations accumulated from multiple merged drafts were removed

Closes #539

---

#536 — Bulk migrate-all helper

Problem: The migration flow required running stellar contract invoke … migrate_meter once per meter by hand — error-prone at scale.

Fix:

• scripts/migrate-all.js — fetches all meters via get_all_meters, calls migrate_meter(meter_id) for each, logs per-meter success/failure, prints a final summary, and exits non-zero if any meter fails (CI-safe)
• make migrate-all CONTRACT_ID=… ADMIN_SECRET_KEY=… Makefile target with required-var guards and DRY_RUN=true support
• README Contract Upgrades section updated to use make migrate-all as the recommended path

make migrate-all CONTRACT_ID=C... ADMIN_SECRET_KEY=S... NETWORK=testnet
make migrate-all CONTRACT_ID=C... ADMIN_SECRET_KEY=S... DRY_RUN=true   # dry run

Closes #536

---

#537 — Document intentional public exposure of /metrics

Problem: GET /metrics had no auth and no written rationale — ambiguous whether this was intentional.

Decision confirmed: Intentionally public. Prometheus's pull model requires unauthenticated HTTP GET. The backend port 3001 is only on the internal Docker app-network — not forwarded publicly. Network isolation is the guard.

Fix:

• Detailed design-decision comment added above app.get('/metrics', …) in index.ts
• New /metrics — intentionally public section in README Observability, including reverse-proxy hardening guidance for public deployments
• infra/prometheus.yml now explicitly sets metrics_path: /metrics with an explanatory comment

Closes #537

---

#538 — CI guard against duplicate package.json keys

Problem: backend/package.json previously shipped with duplicate dependency entries (issue #262). JSON.parse silently keeps the last value, so npm install succeeding gave no signal.

Fix:

• scripts/check-duplicate-pkg-keys.js — custom recursive-descent JSON parser that counts key occurrences and exits 1 on any duplicate, with a clear error message showing the offending path and count
• New check-pkg-duplicates job in .github/workflows/ci.yml runs against both backend/package.json and frontend/package.json on every push/PR

Closes #538

---

Testing

Check	Result
tsc --noEmit	✅ clean (0 errors)
npx vitest run	✅ 48 passed / 21 failed — all failures are pre-existing on main (was 21 passed / 23 failed before this PR)
node scripts/check-duplicate-pkg-keys.js backend/package.json frontend/package.json	✅ no duplicates found
Duplicate detection smoke test	✅ correctly exits 1 on a synthetic duplicate

[drips-wave]

@Good-Coded Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Dev-AdeTutu]

@Good-Coded pls fix conflicts

[Good-Coded]

@Good-Coded pls fix conflicts

@Dev-AdeTutu fixed!