feat: Add portfolio edit and delete API routes and frontend UI #64

Problem

PortfolioStorage has updatePortfolio and deletePortfolio methods, and portfolioDb has the corresponding SQL operations. However, no API routes expose these capabilities.

The routes.ts file defines POST /portfolio, GET /user/:address/portfolios, GET /portfolio/:id, and POST /portfolio/:id/rebalance but has no PUT /portfolio/:id or DELETE /portfolio/:id.

On the frontend, Dashboard.tsx has no edit or delete buttons, and PortfolioSetup.tsx is create-only. Users have no way to modify allocations, change the rebalance threshold, or remove a portfolio once created.

Proposed Fix

1. Add API routes

// PUT /portfolio/:id — update allocations, threshold
// DELETE /portfolio/:id — remove portfolio

Both routes should be protected by rate limiter and ownership check (verify userAddress matches the authenticated user).

2. Add Zod schemas

Create updatePortfolioSchema in validation.ts for partial updates.

3. Add frontend UI

• Edit button in Dashboard.tsx that opens a modal pre-filled with current allocations
• Delete button with a confirmation dialog
• Reuse existing PortfolioSetup form logic for the edit modal

Files to modify

• backend/src/api/routes.ts — add PUT and DELETE routes
• backend/src/api/validation.ts — add updatePortfolioSchema
• frontend/src/components/Dashboard.tsx — add edit/delete UI
• frontend/src/config/api.ts — add new endpoint constants
• backend/src/api/__tests__/routes.test.ts — add route tests

Acceptance Criteria

• PUT /portfolio/:id accepts partial updates, validates, returns updated portfolio
• DELETE /portfolio/:id removes portfolio, returns 204
• Both routes protected by rate limiter and ownership check
• Frontend edit button opens modal with current allocations pre-filled
• Frontend delete button shows confirmation dialog
• Test: PUT /portfolio/:id with valid data returns updated portfolio
• Test: DELETE /portfolio/:id returns 204
• Test: edit/delete by non-owner returns 403
• Test: edit/delete non-existent portfolio returns 404

Affected Area

Backend and Frontend