feat: add 'Report Asset' flow for community moderation (#48)

[Bolajiomo99]

Closes #48

What & Why

This PR adds the community moderation "Report Asset" flow: users can report a marketplace asset, and an asset is automatically flagged for review once it accumulates enough reports.

The backend introduces POST /api/v1/assets/:id/report, which accepts a reporter (Stellar public key) and a reason (enum: Spam, Plagiarism, Malicious, Misleading, PolicyViolation, Other), with an optional details field. Reports are stored in the existing reports table, and once an asset crosses more than 5 total reports, it's auto-flagged (flagged: true) in the same DB transaction as the report insert — mirroring the existing purchaseLicense atomic-write pattern. A new admin-only GET /api/v1/admin/reports endpoint (gated by the existing requireAdmin/x-admin-key middleware) lists reports with the related asset attached, for moderator review.

On the frontend, a new /assets/[id] detail page adds a "Report this asset" button that opens a modal (reason dropdown, optional details textarea, validation, loading/success/error states). This page didn't exist before this PR — it's the minimum needed to host the report flow.

Scope note on on-chain removal: the marketplace contract's delist_asset only accepts the asset owner's own signature (owner.require_auth()), so there's no on-chain admin-override path today. Admin removal of a flagged asset is therefore off-chain only (reuses the existing soft-delete path) rather than adding an admin override to the contract — documented in the backend README. Happy to revisit if an on-chain override is wanted, but that's a contract change, not a moderation-flow change.

Also fixed (pre-existing, blocking): backend/src/routes/internal.js was required by app.js and covered by an existing test file, but missing from disk — the app couldn't boot at all outside of tests that mock Stellar config. pg and @testcontainers/postgresql were used in the codebase but never declared in package.json. config/stellar.js destructured a SorobanRpc export that this SDK version renamed to rpc. Without these three fixes, neither the app nor the test suite could run, so they were prerequisites for verifying this PR at all.

Closes #48

---

Touched surface

• backend/ — Express API, PostgreSQL repositories/services, migrations
• frontend/ — Next.js app
• contract/ — Soroban marketplace contract (untouched — see scope note above)
• docs/ — backend README updated
• CI / config (.github/workflows/, .env.example aside from the new ADMIN_API_KEY line)

---

Settlement & refund semantics

• None of the above — this PR cannot move, hold, or release user funds. It only writes moderation reports and flips an asset's flagged flag.

---

Tests run

• cd backend && npm test — full Jest suite, run locally against a real PostgreSQL instance (Docker wasn't available in my sandbox, so I installed Postgres directly, ran migrations, and
  pointed Jest at it in place of the Docker-based globalSetup): **220/220 tests passetended ones (reportService.test.js, routes/admin.test.js,routes/internal.test.js, plus extended assets.test.js, assetRepository.test.js, reportRepository.test.js)
• cd backend && npm run lint — not run; this repo has no ESLint config committe (pre-existing gap, unrelated to this change)
• cd frontend && npx tsc --noEmit — clean
• cd frontend && npx eslint src/app/assets — clean except one react-hooks/exha's identical to the pre-existing pattern in agents/[id]/page.tsx`
• cd frontend && npx next build — production build succeeds, including the new /assets/[id] route

Free-form outcome:

Filed reports end-to-end via curl against a live local Postgres + backend:
success (201), empty/invalid reason (422), missing/invalid reporter key (422),
unknown asset (404), duplicate open report (409), admin auth gating (401/503/200).
Filed 6 reports from 6 distinct reporters and confirmed the asset flips to
flagged: true and flaggedAt is stamped, then confirmed it surfaces on both
GET /api/v1/assets/:id and GET /api/v1/admin/reports (with asset attached).

---

UI / evidence artefacts

• Frontend visible change → New /assets/[id] page with a "Report this assetn, details, validation, loading/success/error states)

• Coordinator/API change → Added POST /api/v1/assets/:id/report and GET /api/v1/admin/reports. Request/response format, status codes, and the flagging threshold are documented in
  backend/README.md

• Metrics / KPI change

• Status table / README change → backend/README.md route table and a new "Corting Assets" section

• None of the above

• Status table / README change → backend/README.md route table and a new "Community Moderation — Reporting Assets" section

• None of the above

---

Secrets, logging, and PII risk

• No secrets, private keys, RPC credentials, .env content, or wallet mnemonics exampleonly gained a blankADMIN_API_KEY=` line)
• No new console.*/logging statements exposing sensitive information
• No new build flag exposing dev tooling in production
• None of the above

---

Public proof links

n/a

---

Breaking change & rollback

• Breaking change? No — purely additive endpoints and a new frontend page; existing asset responses gain two new fields (flagged, flaggedAt) but no existing field changes shape.
• Migration or feature flag required? A new DB migration (`007_add_asset_flagd runs automatically via the existing migration runner; no feature flag needed.

---

Reviewer checklist

• PR description and code comments are in English
• Linked issue (Add 'Report Asset' flow for community moderation #48)
• No unrelated drive-by changes beyond the three pre-existing boot-blocking bugs ere required to run the app/tests at all
• Tests touch the same files as the source change
• PR is reversible: a single git revert restores prior state

[vestor-dev]

LGTM