audit: 2026-05-30 full-codebase audit — report, issues, docs, runbooks

Full-codebase-audit 2026-05-30 outputs:
- Audit report: 09 - Audits/Full Codebase Audit - 2026-05-30.md
- 81 issue files ISSUE-055..135 (decisions + 1 skipped no-brainer).
- Scanner docs from scratch (was zero): architecture, data model, API ref, payment
  flow, operations runbook + repo README.
- Doc-sync updates across API reference, data models, flows, design system.
- Secret Rotation Runbook (08 - Operations) for the exposed credentials.
- Reusable workflow guide (07 - Development) + .claude/workflows/full-codebase-audit.js.

Issues remain status:open intentionally — the code fixes are uncommitted-then-committed
working-tree changes per repo and aren't "resolved" until merged/deployed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

08 - Operations/Monitoring.md

@@ -11,24 +11,21 @@ What's instrumented today and what to watch. Today's stack is intentionally lean
 
 ## 1. Health endpoint
 
-Path: `GET /health` (backend, port `5001`).
+Two paths are registered (both are public, rate-limited, not auth-gated):
 
-Defined in `backend/src/app.ts`:
+- `GET /health` — simple ping used by Docker healthchecks. Returns `200 { success, message, timestamp, environment, version }`. Does **not** probe MongoDB or Redis.
+- `GET /api/health` — deep health check added in commit `44579d6` (backend v2.6.49). Calls `runHealthChecks` from `backend/src/services/health/healthCheckService.ts`. Probes MongoDB and Redis, collects memory/uptime stats, and returns a structured report. Returns `503` when `report.status === 'down'`.
 
-```ts
-app.get("/health", (req, res) => {
-  res.json({
-    success: true,
-    message: "Marketplace Backend API is running",
-    timestamp: new Date().toISOString(),
-    environment: config.nodeEnv,
-    version: packageJson.version,
-  });
-});
+`GET /api/health` response shape (from `healthCheckService`):
+```json
+{
+  "status": "ok",
+  "version": "2.6.xx",
+  "timestamp": "...",
+  "checks": { "mongodb": "ok", "redis": "ok", "uptime": 3600, "memoryMB": 120 }
+}
 ```
 
-Returns `200` with a JSON envelope as soon as Express is up. Does **not** currently probe MongoDB or Redis — they are checked via separate Docker healthchecks. If you want deep health, extend the endpoint to ping both data stores and return `503` on failure.
-
 Public URL behind Nginx: `https://amn.gg/api/health`.
 
 ---