feat: extend checkDbHealth to report query latency and degraded statu…

[meem08]

closes #172
Closes #223 — adds explicit authorization boundary to analytics aggregation rollup routes to prevent privilege drift.
closes #223

Changes

summary

src/routes/analytics.ts

• Added requireAnalyticsOwner middleware with address normalization via normalizeStarknetAddress
• Mounted requireAuth on /analytics path
• Added requireAnalyticsOwner as route middleware on GET /analytics/:user_address
• Merged with existing Redis cache infrastructure (readDb, analyticsCache, AnalyticsResponse validation)
• Fixed missing ZodError import
• Wired up assertAnalyticsResponseShape response validation guard

Test files (analytics.test.ts, analytics.cache.test.ts, analytics.aggregation.test.ts)

• Added auth middleware mocks for requireAuth and getPrincipal
• Added readDb export to db mock to match updated imports
• 4 authorization tests: 403 for unauthorized address, 401 for missing auth, address normalization, export contract
• Added AnalyticsResponse import for response shape tests

docs/routes/analytics.md

• Full authorization documentation with middleware chain, contract, status matrix, and security notes

src/utils/validation.ts

• Removed duplicate coerceNullOrEmptyToUndefined function and duplicate parsePagination JSDoc

Testing

• 70 tests pass across 3 test files
• Coverage includes success path, 403 (forbidden), 401 (unauthorized), address normalization, and cache isolation by address