feat: replace mock marketplace flows

[somotochukwu-dev]

Replace mock marketplace flows with production-safe request lifecycle management

Summary

Makes marketplace interactions safe for real backend data by validating request
state, auth requirements, and error boundaries around listing fetches and bids.
Both the mock and production providers now enforce the same request contract,
raw backend payloads are sanitized before they reach the UI, and all failures
resolve to clear loading/success/failure states with safe retry behavior.

Closes #525

Changes

1. Clear loading, success, and failure states with safe retry behavior

• app/marketplace/page.tsx
  • Added a monotonic request-id guard to loadListings so stale responses can
    never overwrite fresh data when a retry is triggered while a previous
    request is still in flight.
  • Retries no longer wipe existing listings: cached data stays on screen while
    refetching, an inline error banner (with disabled retry button while
    loading) handles recovery, and the full-page error state only renders when
    nothing has loaded yet.
  • StatsBar / results count remain visible during background refreshes.
• app/marketplace/loading.tsx
  • Route-level skeleton is now announced to assistive tech via
    role="status" + aria-busy="true" with screen-reader text.

2. Request-shape validation before network submission

• hooks/marketplaceApi.ts
  • Added validateBidRequest() — shared structural validation of bid requests
    (username presence/bounds/control characters, finite positive amount,
    optional minimum). Used by both providers so dev/test mirrors production.
  • Added MarketplaceAuthRequiredError, getStoredAuthToken() and
    MARKETPLACE_AUTH_STORAGE_KEY so authenticated endpoints validate auth
    requirements client-side before submitting.
  • Added response sanitizers (sanitizeListing(s), sanitizeUserBids,
    sanitizeUserListings) that coerce raw JSON into domain types: ISO date
    strings become Date, string-encoded numbers become numbers, and entries
    that cannot be repaired are dropped instead of crashing components that
    call .getTime() / .toLocaleString().
• hooks/providers/productionMarketplaceProvider.ts
  • placeBid validates request shape locally — invalid bids never hit the wire.
  • fetchUserBids / fetchUserListings fail fast with a clear signed-out
    message instead of making doomed network calls; the bearer token is attached
    per-request and never logged or embedded in error messages.
  • All fetches sanitize responses through the shared coercers.
• hooks/providers/mockMarketplaceProvider.ts
  • placeBid enforces the exact same validation contract as production and
    rejects invalid input immediately (no simulated wallet delay).
• components/BidModal.tsx
  • Strict numeric parsing (Number.isFinite) replaces parseFloat.
  • Validates the full request shape (including minimum bid) before submission;
    invalid input surfaces as an inline error with no network call.
  • Double-submit guard ignores re-entry while a bid is in flight.
  • Defensive try/catch ensures unexpected provider rejections never crash the modal.

3. Error reporting captures user-visible failures without leaking sensitive details

• hooks/providers/productionMarketplaceProvider.ts
  • Internal failures (network, timeout, HTTP status) are mapped to safe,
    user-facing messages — internal paths and status details never reach users.
  • Bid endpoint responses are parsed defensively; malformed bodies fall back to
    a generic reason, and server-provided reasons are length-bounded.
• components/BidModal.tsx
  • Failed bid submissions are reported through errorReporter with safe
    context fields only (listing id, username, operation) — no request bodies
    or wallet material.
• lib/errorReporter.ts
  • Extended the sensitive-key redaction pattern to also cover wallet and
    transaction material: signature, seed, seedPhrase, mnemonic,
    walletSecret, sessionCookie, cookie.

4. Unblocking fix (required for verification)

• lib/api.ts — fixed a pre-existing syntax error (missing closing brace of
  describeApiError plus a broken doc-comment start at line ~76) that broke
  compilation of the entire frontend. Minimal fix only; no behavior change.

Tests

• New: src/hooks/providers/__tests__/productionMarketplaceProvider.test.ts
  • Date coercion and invalid-entry dropping for listings.
  • Auth fast-fail without network calls; bearer header attached when signed in.
  • Bid request-shape rejection before any fetch; server reason passthrough;
    failure reasons asserted not to leak paths/status internals; malformed
    response fallback.
  • Network and 5xx mapping to connection/unavailability messages.
• Extended: src/hooks/__tests__/mockMarketplaceProvider.test.ts
  • Invalid bids rejected immediately, mirroring the production contract.

Verification

• npx vitest run: all marketplace tests pass (161 passing).
• ESLint clean on all touched files.
• Scoped tsc --noEmit run: no errors in any touched file.

Pre-existing issues intentionally left untouched

These fail on the base branch as well and are outside the scope of this issue:

• Syntax/merge artifacts in app/dashboard/page.tsx, app/settings/page.tsx,
  app/pay/page.tsx, components/Header.tsx (break full-project typecheck).
• 4 failing tests in src/components/__tests__/ErrorReportingShell.test.tsx
  (useOnlineStatus must be used within OnlineStatusProvider).

Files changed

• app/frontend/src/hooks/marketplaceApi.ts
• app/frontend/src/hooks/providers/productionMarketplaceProvider.ts
• app/frontend/src/hooks/providers/mockMarketplaceProvider.ts
• app/frontend/src/hooks/providers/tests/productionMarketplaceProvider.test.ts (new)
• app/frontend/src/hooks/tests/mockMarketplaceProvider.test.ts
• app/frontend/src/components/BidModal.tsx
• app/frontend/src/app/marketplace/page.tsx
• app/frontend/src/app/marketplace/loading.tsx
• app/frontend/src/lib/errorReporter.ts
• app/frontend/src/lib/api.ts (syntax-fix only)