feat(api): add meters-by-plan, ETag, total-shares, and bulk-allowlist endpoints

[yosemite01]

Summary

This PR implements four new backend API features across the stats, meters, collaborators, and allowlist routes.

---

Closes #461 — GET /api/stats/meters-by-plan

File: backend/src/routes/stats.ts

Added a new sub-route under /api/stats that groups all meters by their plan type and returns a breakdown with guaranteed zero counts for any plan type that has no meters. Response is cached for 30 seconds (matching the existing /api/stats TTL).

Response shape:

{ "Daily": 12, "Weekly": 5, "Usage": 3, "total": 20 }

---

Closes #462 — ETag support on GET /api/meters/:id

Files: backend/src/routes/meters.ts, backend/src/middleware/cache.ts

• Exported a new etagFor(data) helper from cache.ts that produces a quoted SHA-1 hash of any JSON-serialisable value.
• Replaced the generic cacheFor(5_000) middleware on the /:id handler with explicit ETag logic: the handler now sets an ETag response header and checks the incoming If-None-Match header, returning 304 Not Modified (no body) when the hashes match.
• Also fixed a pre-existing syntax error in the /:id/status handler (missing }));) that prevented the file from compiling.

---

Closes #463 — GET /api/collaborators/total-shares

File: backend/src/routes/collaborators.ts

Added a lightweight read-only endpoint that sums all collaborator basis points from get_all_shares and returns the total alongside the remaining headroom to 10 000 bps. Response is cached for 5 seconds. Also added the missing requireAdminKey import that was referenced but not imported in the existing POST and DELETE handlers.

Response shape:

{ "total_basis_points": 7500, "remaining": 2500 }

---

Closes #464 — POST /api/allowlist/bulk

File: backend/src/routes/allowlist.ts

Added a bulk-add endpoint at POST /api/allowlist/bulk protected by requireAdminKey. It accepts { addresses: string[] } (max 50 items), validates each entry as a valid Stellar Ed25519 public key, submits each individually via adminInvoke, and returns per-address results allowing partial success. Also cleaned up the malformed duplicate router definition that existed in the original file.

Response shape:

{
  "results": [
    { "address": "G...", "hash": "abc123..." },
    { "address": "GBAD...", "error": "Invalid Stellar public key" }
  ]
}

---

Files changed

File	Change
backend/src/routes/stats.ts	New GET /api/stats/meters-by-plan route + 30 s cache
backend/src/middleware/cache.ts	New etagFor() export
backend/src/routes/meters.ts	ETag on /:id, fixed /:id/status syntax error
backend/src/routes/collaborators.ts	New GET /total-shares route, added missing requireAdminKey import
backend/src/routes/allowlist.ts	New POST /bulk route, cleaned up duplicate router definition

🤖 Generated with Claude Code

[drips-wave]

@yosemite01 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits