feat: export tests, deprecation registry, profile UX, and gitleaks patterns

[Jaydbrown]

Closes #463

---

Closes #473

---

Closes #466

---

Closes #485

---

Summary

• Campaign export unit tests — covers CSV headers/columns, JSON shape, rate limiting (429 + Retry-After, per-actor isolation), date range filter, audit log creation, non-fatal audit errors, and referrals-only fallback (Backend: Add campaign metrics CSV/JSON export endpoint #463)
• Deprecation middleware: injectable registry — createDeprecationMiddleware now accepts an optional registry parameter (defaults to DEPRECATION_REGISTRY), enabling isolated unit tests without module mocking (Backend: Add API versioning header and deprecation notices #466)
• Deprecation middleware tests — 9 tests: header injection, parameterised path matching, method mismatch, segment-count mismatch, WARN logging, log silence for non-deprecated routes, valid HTTP date format, empty registry safety (Backend: Add API versioning header and deprecation notices #466)
• Populated deprecation registry — all legacy /api/ campaign routes now have 90-day sunset entries pointing to their /api/v1/ successors (campaigns, campaigns/:id, stats, export — GET/POST/PUT/DELETE) (Backend: Add API versioning header and deprecation notices #466)
• User profile: retry + empty-state UX — added inline Retry button inside the error alert, a standalone Refresh button next to Share Profile, and a dedicated empty-state panel with a "Browse campaigns →" link for new wallets with no activity (Frontend: Add user profile page (activity summary, campaigns, rewards history) #473)
• Gitleaks: additional secret patterns — PEM private key blocks, JWT_SECRET env assignments, generic *_SECRET/*_PRIVATE_KEY high-entropy values, and KEEPER_SECRET_KEY Stellar assignments (DevOps: Add secrets scanning in CI (prevent accidental key commits) #485)

Changes

File	Type	Issue
backend/src/routes/campaignExport.test.js	NEW	#463
backend/src/middleware/deprecationNotice.js	UPDATED	#466
backend/src/middleware/deprecationNotice.test.js	NEW	#466
backend/src/deprecations.js	UPDATED	#466
frontend/src/pages/UserProfile.jsx	UPDATED	#473
.gitleaks.toml	UPDATED	#485

Test plan

• npm run test:backend — all export and deprecation tests pass
• Hit GET /api/campaigns — response includes Deprecation, Sunset, Link headers
• Hit GET /api/v1/campaigns — no deprecation headers
• Hit /profile with a brand-new wallet — empty-state panel appears instead of blank sections
• Hit /profile with a network error — error alert shows Retry button; clicking it re-fetches
• Gitleaks scan passes on a file containing a known-safe Stellar pubkey (G...) and fails on a secret key (S...)

[vercel]

@Jaydbrown is attempting to deploy a commit to the joelpeace48-cell's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Jaydbrown Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits