[mopxam-art]

Overview

Closes #911 by standardizing HTTP 404 responses for missing benchmark resources, validating metrics against the supported set, enforcing non-negative ordering on thresholds, guarding custom definition collisions with built-in benchmarks, and protecting benchmark mutations with admin bearer authentication.

Changes

• src/routes/benchmarking.ts:
  • Updated GET /benchmarks/:id and GET /:id/trend to return HTTP 404 (notFound) when a requested benchmark id does not exist.
  • Added requireAdminBearer middleware to POST /benchmarks to ensure consumer API keys cannot mutate global benchmark definitions.
  • Validated metric against KNOWN_METRICS with strict 400 rejection on unknown metrics.
  • Validated thresholds non-negativity and monotonic order (poor <= fair <= good <= excellent).
  • Rejected direct and slug-derived id collisions against built-in benchmarks.
• src/lib/benchmarking.ts:
  • Exported KNOWN_METRICS, isKnownMetric, isBuiltInBenchmark, getBuiltInBenchmarkIds, and clearCustomBenchmarks.
  • Hardened defineCustomBenchmark to reject built-in ID overwrites.
• src/middleware/errors.ts: Exported standard notFound(message) helper returning ApiError(404, 'not_found', message).
• src/__tests__/benchmarking.test.ts: Fixed mislabeled test asserting 400 to assert 404.
• src/__tests__/benchmarking-5d-matrix.test.ts: Added 111 comprehensive tests across boundaries, combinatorics, parameter variations, negative controls, and lifecycle.

Verification

• All 121 benchmarking tests pass green (npx jest src/__tests__/benchmarking*).
• TypeScript typecheck passes with 0 errors (npx tsc --noEmit).
• ESLint passes with 0 warnings/errors.