Add Excel (.xlsx) export for API datasets

[Copilot]

The service could only return data as GraphQL JSON; there was no way to hand a portfolio snapshot or trade history to someone who works in a spreadsheet. This adds .xlsx downloads for the data the API already serves.

curl http://localhost:4000/export                    # {"datasets":[...],"format":"xlsx"}
curl -O -J 'http://localhost:4000/export/trades.xlsx?accountId=acct-1&limit=50'

Changes

• src/export/xlsx.js — minimal OOXML writer (ZIP via node:zlib, inline strings, numeric/boolean cells, XML escaping, Excel-safe sheet names). Written in-process to avoid pulling in a ~100-package spreadsheet dependency into a 5-dependency service.
• src/export/datasets.js — dataset registry (users, posts, portfolio, trades, tax-estimate) with column specs, loading rows from the same store and finance service the resolvers use so exports and queries stay consistent.
• src/export/router.js — GET /export lists datasets; GET /export/:dataset(.xlsx) streams the workbook with attachment headers. Finance datasets accept the GraphQL filter/pagination params (accountId, symbol, side, status, from, to, limit, offset, taxYear). Unknown dataset → 404, missing taxYear → 400.
• Partial upstream data — when finance connectors report errors, the workbook gets an extra Errors sheet rather than silently shipping an incomplete export.
• src/index.js — mounts the router at /export with CORS, alongside /graphql, /health, /ready, /metrics.
• test/export.test.js, README — tests unzip and assert the generated XML, dataset shapes, and route status codes; README documents the endpoint and dataset table.

Notes for review: cells are untyped/unstyled (dates and currency export as ISO strings and raw numbers), and exports are unauthenticated like the rest of the demo endpoints.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

🟡 Changes recommended

A critical XML-validity issue and moderate validation and scalability issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

src/export/datasets.js:182

• The GraphQL contract rejects taxYear outside 1900–9999, but this loader only checks presence. For example, taxYear=1 reaches finance.taxEstimate and can produce a successful empty estimate instead of the API's 400 response, so this export does not actually match the advertised query contract. Apply the same range check before calling the service.

      if (params.taxYear === undefined) {
        throw Object.assign(new Error('taxYear query parameter is required'), { statusCode: 400 });
      }

src/export/router.js:37

• The Errors sheet is the mechanism promised for partial finance exports, but the added tests only cover successful finance results and never supply a result with errors. A regression could therefore silently omit upstream diagnostics while all export tests pass. Add a connector-failure case and assert that the downloaded workbook contains an Errors sheet with the source/code/message fields.

      // Partial finance results carry upstream errors; surface them in the
      // workbook instead of silently shipping incomplete data.
      const allSheets = errors.length > 0 ? [...sheets, { name: 'Errors', columns: ERROR_COLUMNS, rows: errors }] : sheets;

• Files reviewed: 6/6 changed files
• Comments generated: 3
• Review effort level: Lite