From 3c6eaf4c3aa82d87fc382b52324a96f858603754 Mon Sep 17 00:00:00 2001
From: ussyalfaks <usmanalfaki@gmail.com>
Date: Mon, 1 Jun 2026 00:40:46 +0100
Subject: [PATCH] feat(backend): implement APM, request validation, DB pool
 optimization, and E2E tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[Backend] — No Application Performance Monitoring Integration
Fixes #683

[Backend] -- Add Database Connection Pooling Optimization
Fixes #838

[Backend] --  Implement Request Validation Middleware
Fixes #839

[Backend] -- Add E2E API Tests
Fixes #840
---
 backend/src/app.module.ts                     |  12 +
 .../common/database/connection-pool.config.ts | 183 +++++++++---
 .../database/connection-pool.controller.ts    |  63 ++++
 .../common/database/connection-pool.module.ts |   7 +-
 .../database/connection-retry.service.ts      | 167 +++++++++++
 .../common/database/typeorm-pool.config.ts    |  95 ++++--
 .../filters/validation-exception.filter.ts    | 110 +++++++
 .../middleware/validation.middleware.ts       | 120 ++++++++
 .../validators/is-iso-date.validator.ts       |  52 ++++
 .../is-positive-amount.validator.ts           |  69 +++++
 .../common/validators/is-uuid.validator.ts    |  27 ++
 backend/src/main.ts                           |   8 +-
 backend/src/modules/apm/apm.controller.ts     | 101 +++++++
 backend/src/modules/apm/apm.interceptor.ts    |  85 ++++++
 backend/src/modules/apm/apm.module.ts         |  14 +
 backend/src/modules/apm/apm.service.ts        | 260 ++++++++++++++++
 .../apm/distributed-tracing.service.ts        | 205 +++++++++++++
 backend/src/modules/apm/metrics.service.ts    | 279 ++++++++++++++++++
 backend/test/auth.e2e-spec.ts                 | 245 +++++++++++++++
 backend/test/fixtures/database.helpers.ts     |  45 +++
 backend/test/fixtures/test-factories.ts       |  83 ++++++
 backend/test/health.e2e-spec.ts               |  59 ++++
 backend/test/jest-e2e-setup.ts                |  16 +
 backend/test/jest-e2e.json                    |  26 +-
 backend/test/savings.e2e-spec.ts              | 160 ++++++++++
 backend/test/transactions.e2e-spec.ts         | 167 +++++++++++
 backend/test/users.e2e-spec.ts                | 177 +++++++++++
 27 files changed, 2775 insertions(+), 60 deletions(-)
 create mode 100644 backend/src/common/database/connection-pool.controller.ts
 create mode 100644 backend/src/common/database/connection-retry.service.ts
 create mode 100644 backend/src/common/filters/validation-exception.filter.ts
 create mode 100644 backend/src/common/middleware/validation.middleware.ts
 create mode 100644 backend/src/common/validators/is-iso-date.validator.ts
 create mode 100644 backend/src/common/validators/is-positive-amount.validator.ts
 create mode 100644 backend/src/common/validators/is-uuid.validator.ts
 create mode 100644 backend/src/modules/apm/apm.controller.ts
 create mode 100644 backend/src/modules/apm/apm.interceptor.ts
 create mode 100644 backend/src/modules/apm/apm.module.ts
 create mode 100644 backend/src/modules/apm/apm.service.ts
 create mode 100644 backend/src/modules/apm/distributed-tracing.service.ts
 create mode 100644 backend/src/modules/apm/metrics.service.ts
 create mode 100644 backend/test/auth.e2e-spec.ts
 create mode 100644 backend/test/fixtures/database.helpers.ts
 create mode 100644 backend/test/fixtures/test-factories.ts
 create mode 100644 backend/test/health.e2e-spec.ts
 create mode 100644 backend/test/savings.e2e-spec.ts
 create mode 100644 backend/test/transactions.e2e-spec.ts
 create mode 100644 backend/test/users.e2e-spec.ts

diff --git a/backend/src/app.module.ts b/backend/src/app.module.ts
index 4fa319428..19290dd45 100644
--- a/backend/src/app.module.ts
+++ b/backend/src/app.module.ts
@@ -8,6 +8,8 @@ import { AuditLogInterceptor } from './common/interceptors/audit-log.interceptor
 import { RequestLoggingInterceptor } from './common/interceptors/request-logging.interceptor';
 import { GracefulShutdownInterceptor } from './common/interceptors/graceful-shutdown.interceptor';
 import { TieredThrottlerGuard } from './common/guards/tiered-throttler.guard';
+import { ApmModule } from './modules/apm/apm.module';
+import { ApmInterceptor } from './modules/apm/apm.interceptor';
 import { CommonModule } from './common/common.module';
 import { EventEmitterModule } from '@nestjs/event-emitter';
 import { LoggerModule } from 'nestjs-pino';
@@ -47,6 +49,7 @@ import { ConnectionPoolModule } from './common/database/connection-pool.module';
 import { CircuitBreakerModule } from './common/circuit-breaker/circuit-breaker.module';
 import { PostmanModule } from './common/postman/postman.module';
 import { CorrelationIdMiddleware } from './common/middleware/correlation-id.middleware';
+import { RequestValidationMiddleware } from './common/middleware/validation.middleware';
 import { PerformanceModule } from './modules/performance/performance.module';
 import { GracefulShutdownService } from './common/services/graceful-shutdown.service';
 
@@ -95,6 +98,9 @@ const envValidationSchema = Joi.object({
   BACKUP_ENCRYPTION_KEY: Joi.string().length(64).optional(), // 32-byte key as hex
   BACKUP_RETENTION_DAYS: Joi.number().integer().min(1).default(30).optional(),
   BACKUP_TMP_DIR: Joi.string().optional(),
+
+  APM_SAMPLING_RATE: Joi.number().min(0).max(1).default(1.0).optional(),
+  APM_ENABLED: Joi.boolean().default(true).optional(),
 });
 
 @Module({
@@ -209,6 +215,7 @@ const envValidationSchema = Joi.object({
     DataExportModule,
     ConnectionPoolModule,
     CircuitBreakerModule,
+    ApmModule,
     PostmanModule,
     PerformanceModule,
     CommonModule,
@@ -254,10 +261,15 @@ const envValidationSchema = Joi.object({
       provide: APP_INTERCEPTOR,
       useClass: GracefulShutdownInterceptor,
     },
+    {
+      provide: APP_INTERCEPTOR,
+      useClass: ApmInterceptor,
+    },
   ],
 })
 export class AppModule {
   configure(consumer: MiddlewareConsumer) {
     consumer.apply(CorrelationIdMiddleware).forRoutes('*');
+    consumer.apply(RequestValidationMiddleware).forRoutes('*');
   }
 }
diff --git a/backend/src/common/database/connection-pool.config.ts b/backend/src/common/database/connection-pool.config.ts
index e85a4ecab..2e15740ae 100644
--- a/backend/src/common/database/connection-pool.config.ts
+++ b/backend/src/common/database/connection-pool.config.ts
@@ -1,4 +1,4 @@
-import { Injectable, Logger } from '@nestjs/common';
+import { Injectable, Logger, OnModuleInit, OnModuleDestroy } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { DataSource } from 'typeorm';
 
@@ -8,42 +8,101 @@ export interface PoolMetrics {
   waitingRequests: number;
   totalConnections: number;
   utilizationPercentage: number;
+  maxPoolSize: number;
+  minPoolSize: number;
   timestamp: Date;
 }
 
+export interface PoolHealthStatus {
+  healthy: boolean;
+  utilizationPercentage: number;
+  waitingRequests: number;
+  latencyMs: number;
+  message: string;
+}
+
 @Injectable()
-export class ConnectionPoolService {
+export class ConnectionPoolService implements OnModuleInit, OnModuleDestroy {
   private readonly logger = new Logger(ConnectionPoolService.name);
   private metrics: PoolMetrics[] = [];
   private readonly maxMetricsHistory = 1000;
+  private monitoringInterval: NodeJS.Timeout | null = null;
+  private acquisitionTimes: number[] = [];
+  private readonly maxAcquisitionSamples = 500;
 
   constructor(
     private configService: ConfigService,
     private dataSource: DataSource,
-  ) {
+  ) {}
+
+  onModuleInit() {
     this.initializePoolMonitoring();
+    this.logPoolConfiguration();
+  }
+
+  onModuleDestroy() {
+    if (this.monitoringInterval) {
+      clearInterval(this.monitoringInterval);
+      this.monitoringInterval = null;
+    }
+  }
+
+  private logPoolConfiguration() {
+    const pool = this.getPool();
+    if (!pool) return;
+
+    this.logger.log('Database connection pool initialized', {
+      max: pool.options?.max,
+      min: pool.options?.min,
+      idleTimeoutMillis: pool.options?.idleTimeoutMillis,
+      connectionTimeoutMillis: pool.options?.connectionTimeoutMillis,
+    });
   }
 
   private initializePoolMonitoring() {
-    setInterval(() => {
+    const intervalMs = parseInt(
+      this.configService.get<string>('DB_POOL_MONITOR_INTERVAL') || '30000',
+      10,
+    );
+
+    this.monitoringInterval = setInterval(() => {
       this.collectMetrics();
-    }, 30000); // Collect every 30 seconds
+      this.checkPoolHealth();
+    }, intervalMs);
+  }
+
+  private getPool(): any {
+    return (this.dataSource.driver as any).pool;
   }
 
   private collectMetrics() {
     try {
-      const pool = (this.dataSource.driver as any).pool;
+      const pool = this.getPool();
       if (!pool) return;
 
+      const maxPoolSize = this.configService.get<number>('DATABASE_POOL_MAX', 20);
+      const minPoolSize = this.configService.get<number>('DATABASE_POOL_MIN', 2);
+
+      const activeConnections =
+        pool._activeConnections?.length ??
+        pool.totalCount - pool.idleCount ??
+        0;
+      const idleConnections =
+        pool._idleConnections?.length ?? pool.idleCount ?? 0;
+      const waitingRequests =
+        pool._waitingRequests?.length ?? pool.waitingCount ?? 0;
+      const totalConnections =
+        pool._allConnections?.length ?? pool.totalCount ?? activeConnections + idleConnections;
+
       const metrics: PoolMetrics = {
-        activeConnections: pool._activeConnections?.length || 0,
-        idleConnections: pool._idleConnections?.length || 0,
-        waitingRequests: pool._waitingRequests?.length || 0,
-        totalConnections: pool._allConnections?.length || 0,
+        activeConnections,
+        idleConnections,
+        waitingRequests,
+        totalConnections,
         utilizationPercentage:
-          ((pool._activeConnections?.length || 0) /
-            (pool._allConnections?.length || 1)) *
-          100,
+          totalConnections > 0 ? (activeConnections / maxPoolSize) * 100 : 0,
+        maxPoolSize,
+        minPoolSize,
         timestamp: new Date(),
       };
 
@@ -52,17 +111,15 @@ export class ConnectionPoolService {
         this.metrics.shift();
       }
 
-      // Alert on high utilization
       if (metrics.utilizationPercentage > 80) {
         this.logger.warn(
-          `High connection pool utilization: ${metrics.utilizationPercentage.toFixed(2)}%`,
+          `High connection pool utilization: ${metrics.utilizationPercentage.toFixed(2)}% (${activeConnections}/${maxPoolSize})`,
         );
       }
 
-      // Alert on waiting requests
-      if (metrics.waitingRequests > 5) {
+      if (waitingRequests > 5) {
         this.logger.warn(
-          `Connection pool queue building up: ${metrics.waitingRequests} waiting requests`,
+          `Connection pool queue building: ${waitingRequests} requests waiting`,
         );
       }
     } catch (error) {
@@ -70,6 +127,25 @@ export class ConnectionPoolService {
     }
   }
 
+  private async checkPoolHealth(): Promise<void> {
+    const start = Date.now();
+    try {
+      await this.dataSource.query('SELECT 1');
+      const latencyMs = Date.now() - start;
+
+      this.acquisitionTimes.push(latencyMs);
+      if (this.acquisitionTimes.length > this.maxAcquisitionSamples) {
+        this.acquisitionTimes.shift();
+      }
+
+      if (latencyMs > 500) {
+        this.logger.warn(`Slow DB health check: ${latencyMs}ms`);
+      }
+    } catch (error) {
+      this.logger.error('Pool health check failed', error);
+    }
+  }
+
   getMetrics(): PoolMetrics[] {
     return this.metrics;
   }
@@ -80,43 +156,84 @@ export class ConnectionPoolService {
       : null;
   }
 
-  getAverageUtilization(minutes: number = 5): number {
+  getAverageUtilization(minutes = 5): number {
     const cutoff = new Date(Date.now() - minutes * 60 * 1000);
     const recentMetrics = this.metrics.filter((m) => m.timestamp > cutoff);
-
     if (recentMetrics.length === 0) return 0;
-
-    const sum = recentMetrics.reduce(
-      (acc, m) => acc + m.utilizationPercentage,
-      0,
+    return (
+      recentMetrics.reduce((acc, m) => acc + m.utilizationPercentage, 0) /
+      recentMetrics.length
     );
-    return sum / recentMetrics.length;
   }
 
-  async checkPoolHealth(): Promise<boolean> {
+  async checkPoolHealth_(): Promise<boolean> {
     try {
       const result = await this.dataSource.query('SELECT 1');
       return !!result;
-    } catch (error) {
-      this.logger.error('Pool health check failed', error);
+    } catch {
       return false;
     }
   }
 
+  async getHealthStatus(): Promise<PoolHealthStatus> {
+    const start = Date.now();
+    const healthy = await this.checkPoolHealth_();
+    const latencyMs = Date.now() - start;
+    const latest = this.getLatestMetrics();
+
+    return {
+      healthy,
+      utilizationPercentage: latest?.utilizationPercentage ?? 0,
+      waitingRequests: latest?.waitingRequests ?? 0,
+      latencyMs,
+      message: healthy
+        ? `Pool healthy, ${latencyMs}ms latency`
+        : 'Pool unhealthy - connection check failed',
+    };
+  }
+
   async detectConnectionLeaks(): Promise<number> {
-    const pool = (this.dataSource.driver as any).pool;
+    const pool = this.getPool();
     if (!pool) return 0;
 
-    const activeConnections = pool._activeConnections?.length || 0;
+    const activeConnections = pool._activeConnections?.length ?? 0;
     const maxPoolSize = this.configService.get<number>('DATABASE_POOL_MAX', 20);
 
     if (activeConnections > maxPoolSize * 0.9) {
       this.logger.warn(
-        `Potential connection leak detected: ${activeConnections}/${maxPoolSize}`,
+        `Potential connection leak: ${activeConnections}/${maxPoolSize} connections active`,
       );
-      return activeConnections;
     }
 
-    return 0;
+    return activeConnections;
+  }
+
+  getConnectionAcquisitionStats() {
+    const times = this.acquisitionTimes;
+    if (times.length === 0) {
+      return { samples: 0, avgMs: 0, p95Ms: 0, p99Ms: 0, maxMs: 0 };
+    }
+
+    const sorted = [...times].sort((a, b) => a - b);
+    return {
+      samples: times.length,
+      avgMs: times.reduce((a, b) => a + b, 0) / times.length,
+      p95Ms: sorted[Math.floor(sorted.length * 0.95)] || 0,
+      p99Ms: sorted[Math.floor(sorted.length * 0.99)] || 0,
+      maxMs: sorted[sorted.length - 1] || 0,
+    };
+  }
+
+  getPoolSummary() {
+    const latest = this.getLatestMetrics();
+    const avgUtil5m = this.getAverageUtilization(5);
+    const avgUtil30m = this.getAverageUtilization(30);
+
+    return {
+      current: latest,
+      averageUtilization: { last5Minutes: avgUtil5m, last30Minutes: avgUtil30m },
+      acquisitionLatency: this.getConnectionAcquisitionStats(),
+      metricsCollected: this.metrics.length,
+    };
   }
 }
diff --git a/backend/src/common/database/connection-pool.controller.ts b/backend/src/common/database/connection-pool.controller.ts
new file mode 100644
index 000000000..ad6321aab
--- /dev/null
+++ b/backend/src/common/database/connection-pool.controller.ts
@@ -0,0 +1,63 @@
+import { Controller, Get, Post, UseGuards } from '@nestjs/common';
+import {
+  ApiTags,
+  ApiOperation,
+  ApiResponse,
+  ApiBearerAuth,
+} from '@nestjs/swagger';
+import { ConnectionPoolService } from './connection-pool.config';
+import { ConnectionRetryService } from './connection-retry.service';
+import { JwtAuthGuard } from '../../auth/guards/jwt-auth.guard';
+
+@ApiTags('Database Pool')
+@Controller('db/pool')
+@UseGuards(JwtAuthGuard)
+@ApiBearerAuth('access-token')
+export class ConnectionPoolController {
+  constructor(
+    private readonly poolService: ConnectionPoolService,
+    private readonly retryService: ConnectionRetryService,
+  ) {}
+
+  @Get('summary')
+  @ApiOperation({ summary: 'Get connection pool summary with utilization trends' })
+  @ApiResponse({ status: 200, description: 'Pool summary including current metrics, averages, and acquisition latency' })
+  getSummary() {
+    return this.poolService.getPoolSummary();
+  }
+
+  @Get('metrics')
+  @ApiOperation({ summary: 'Get raw connection pool metrics history' })
+  getMetrics() {
+    return {
+      metrics: this.poolService.getMetrics(),
+      latest: this.poolService.getLatestMetrics(),
+    };
+  }
+
+  @Get('health')
+  @ApiOperation({ summary: 'Check connection pool health' })
+  async getHealth() {
+    return this.poolService.getHealthStatus();
+  }
+
+  @Get('leaks')
+  @ApiOperation({ summary: 'Detect potential connection leaks' })
+  async detectLeaks() {
+    const leaked = await this.poolService.detectConnectionLeaks();
+    return { suspectedLeaks: leaked };
+  }
+
+  @Post('reconnect')
+  @ApiOperation({ summary: 'Force a reconnection health check' })
+  async reconnect() {
+    const success = await this.retryService.checkAndReconnect();
+    return { success, timestamp: new Date().toISOString() };
+  }
+
+  @Get('retry-stats')
+  @ApiOperation({ summary: 'Get connection retry statistics' })
+  getRetryStats() {
+    return this.retryService.getRetryStats();
+  }
+}
diff --git a/backend/src/common/database/connection-pool.module.ts b/backend/src/common/database/connection-pool.module.ts
index a547ea26e..f225f78dc 100644
--- a/backend/src/common/database/connection-pool.module.ts
+++ b/backend/src/common/database/connection-pool.module.ts
@@ -1,8 +1,11 @@
 import { Module } from '@nestjs/common';
 import { ConnectionPoolService } from './connection-pool.config';
+import { ConnectionRetryService } from './connection-retry.service';
+import { ConnectionPoolController } from './connection-pool.controller';
 
 @Module({
-  providers: [ConnectionPoolService],
-  exports: [ConnectionPoolService],
+  controllers: [ConnectionPoolController],
+  providers: [ConnectionPoolService, ConnectionRetryService],
+  exports: [ConnectionPoolService, ConnectionRetryService],
 })
 export class ConnectionPoolModule {}
diff --git a/backend/src/common/database/connection-retry.service.ts b/backend/src/common/database/connection-retry.service.ts
new file mode 100644
index 000000000..2874d4ef7
--- /dev/null
+++ b/backend/src/common/database/connection-retry.service.ts
@@ -0,0 +1,167 @@
+import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { DataSource } from 'typeorm';
+
+export interface RetryConfig {
+  maxRetries: number;
+  initialDelayMs: number;
+  maxDelayMs: number;
+  backoffMultiplier: number;
+  jitterMs: number;
+}
+
+export interface RetryAttempt {
+  attempt: number;
+  delayMs: number;
+  timestamp: Date;
+  error?: string;
+  success: boolean;
+}
+
+@Injectable()
+export class ConnectionRetryService implements OnModuleInit {
+  private readonly logger = new Logger(ConnectionRetryService.name);
+  private readonly retryHistory: RetryAttempt[] = [];
+  private readonly maxHistorySize = 500;
+
+  private readonly config: RetryConfig = {
+    maxRetries: parseInt(process.env.DB_MAX_RETRIES || '5', 10),
+    initialDelayMs: parseInt(process.env.DB_RETRY_INITIAL_DELAY || '500', 10),
+    maxDelayMs: parseInt(process.env.DB_RETRY_MAX_DELAY || '30000', 10),
+    backoffMultiplier: parseFloat(process.env.DB_RETRY_BACKOFF || '2.0'),
+    jitterMs: parseInt(process.env.DB_RETRY_JITTER || '100', 10),
+  };
+
+  constructor(
+    private readonly configService: ConfigService,
+    private readonly dataSource: DataSource,
+  ) {}
+
+  onModuleInit() {
+    this.verifyConnection();
+  }
+
+  private async verifyConnection(): Promise<void> {
+    try {
+      await this.dataSource.query('SELECT 1');
+      this.logger.log('Database connection verified successfully');
+    } catch (error) {
+      this.logger.warn('Initial DB connection check failed, will retry on demand');
+    }
+  }
+
+  async executeWithRetry<T>(
+    operation: () => Promise<T>,
+    operationName = 'db_operation',
+  ): Promise<T> {
+    let attempt = 0;
+    let lastError: Error | undefined;
+
+    while (attempt <= this.config.maxRetries) {
+      try {
+        const result = await operation();
+        if (attempt > 0) {
+          this.recordAttempt(attempt, 0, undefined, true);
+          this.logger.log(`Operation '${operationName}' succeeded after ${attempt} retries`);
+        }
+        return result;
+      } catch (error) {
+        lastError = error instanceof Error ? error : new Error(String(error));
+
+        if (!this.isRetryableError(lastError)) {
+          throw lastError;
+        }
+
+        const delay = this.calculateDelay(attempt);
+        this.recordAttempt(attempt + 1, delay, lastError.message, false);
+
+        this.logger.warn(
+          `Operation '${operationName}' failed (attempt ${attempt + 1}/${this.config.maxRetries + 1}), retrying in ${delay}ms: ${lastError.message}`,
+        );
+
+        if (attempt < this.config.maxRetries) {
+          await this.sleep(delay);
+        }
+
+        attempt++;
+      }
+    }
+
+    throw lastError || new Error(`Operation '${operationName}' failed after ${this.config.maxRetries} retries`);
+  }
+
+  async checkAndReconnect(): Promise<boolean> {
+    try {
+      await this.dataSource.query('SELECT 1');
+      return true;
+    } catch {
+      this.logger.warn('Connection lost, attempting to reconnect...');
+      return this.executeWithRetry(
+        async () => {
+          if (!this.dataSource.isInitialized) {
+            await this.dataSource.initialize();
+          }
+          await this.dataSource.query('SELECT 1');
+          return true;
+        },
+        'reconnect',
+      ).catch(() => false);
+    }
+  }
+
+  private isRetryableError(error: Error): boolean {
+    const retryableMessages = [
+      'connection refused',
+      'connection terminated',
+      'connection timeout',
+      'too many connections',
+      'remaining connection slots are reserved',
+      'econnreset',
+      'econnrefused',
+      'etimedout',
+      'socket hang up',
+      'connection lost',
+    ];
+
+    const message = error.message.toLowerCase();
+    return retryableMessages.some((msg) => message.includes(msg));
+  }
+
+  private calculateDelay(attempt: number): number {
+    const base =
+      this.config.initialDelayMs *
+      Math.pow(this.config.backoffMultiplier, attempt);
+    const jitter = Math.random() * this.config.jitterMs;
+    return Math.min(base + jitter, this.config.maxDelayMs);
+  }
+
+  private sleep(ms: number): Promise<void> {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+
+  private recordAttempt(
+    attempt: number,
+    delayMs: number,
+    error: string | undefined,
+    success: boolean,
+  ): void {
+    this.retryHistory.push({ attempt, delayMs, timestamp: new Date(), error, success });
+    if (this.retryHistory.length > this.maxHistorySize) {
+      this.retryHistory.shift();
+    }
+  }
+
+  getRetryStats() {
+    const total = this.retryHistory.length;
+    const failures = this.retryHistory.filter((r) => !r.success);
+    const successes = this.retryHistory.filter((r) => r.success && r.attempt > 0);
+
+    return {
+      totalAttempts: total,
+      retryFailures: failures.length,
+      retrySuccesses: successes.length,
+      config: this.config,
+      recentHistory: this.retryHistory.slice(-20),
+    };
+  }
+}
diff --git a/backend/src/common/database/typeorm-pool.config.ts b/backend/src/common/database/typeorm-pool.config.ts
index 5d54de529..353349e72 100644
--- a/backend/src/common/database/typeorm-pool.config.ts
+++ b/backend/src/common/database/typeorm-pool.config.ts
@@ -1,11 +1,53 @@
 import { TypeOrmModuleOptions } from '@nestjs/typeorm';
 import { ConfigService } from '@nestjs/config';
 
+/**
+ * Pool size guidelines:
+ *   Production : max = (num_cpu_cores * 2) + 1 capped at 30, min = max/4
+ *   Staging    : max = 10, min = 2
+ *   Test       : max = 5, min = 1 (keeps CI fast)
+ *   Development: max = 5, min = 2
+ */
+function getOptimalPoolSize(env: string): { max: number; min: number } {
+  switch (env) {
+    case 'production':
+      return { max: 20, min: 5 };
+    case 'staging':
+      return { max: 10, min: 2 };
+    case 'test':
+      return { max: 5, min: 1 };
+    default:
+      return { max: 5, min: 2 };
+  }
+}
+
 export function getTypeOrmConfig(
   configService: ConfigService,
 ): TypeOrmModuleOptions {
   const nodeEnv = configService.get<string>('NODE_ENV', 'development');
   const isProduction = nodeEnv === 'production';
+  const defaults = getOptimalPoolSize(nodeEnv);
+
+  const poolMax = configService.get<number>('DATABASE_POOL_MAX', defaults.max);
+  const poolMin = configService.get<number>('DATABASE_POOL_MIN', defaults.min);
+
+  // Idle timeout: production keeps connections longer to avoid reconnect cost
+  const idleTimeout = configService.get<number>(
+    'DATABASE_IDLE_TIMEOUT',
+    isProduction ? 60000 : 30000,
+  );
+
+  // Connection acquisition timeout: fail fast if pool exhausted
+  const connectionTimeout = configService.get<number>(
+    'DATABASE_CONNECTION_TIMEOUT',
+    isProduction ? 5000 : 2000,
+  );
+
+  // Statement timeout: kill runaway queries
+  const statementTimeout = configService.get<number>(
+    'DATABASE_STATEMENT_TIMEOUT',
+    isProduction ? 30000 : 15000,
+  );
 
   return {
     type: 'postgres',
@@ -17,29 +59,38 @@ export function getTypeOrmConfig(
     entities: [__dirname + '/../../**/*.entity{.ts,.js}'],
     migrations: [__dirname + '/../../migrations/*{.ts,.js}'],
     synchronize: !isProduction,
-    logging: !isProduction,
-    // Connection pooling configuration
+    logging: !isProduction
+      ? ['error', 'warn', 'query']
+      : ['error'],
+    maxQueryExecutionTime: configService.get<number>(
+      'DB_SLOW_QUERY_THRESHOLD',
+      500,
+    ),
     extra: {
-      max: configService.get<number>(
-        'DATABASE_POOL_MAX',
-        isProduction ? 30 : 10,
-      ),
-      min: configService.get<number>('DATABASE_POOL_MIN', isProduction ? 5 : 2),
-      idleTimeoutMillis: configService.get<number>(
-        'DATABASE_IDLE_TIMEOUT',
-        30000,
-      ),
-      connectionTimeoutMillis: configService.get<number>(
-        'DATABASE_CONNECTION_TIMEOUT',
-        2000,
-      ),
-      // Enable connection validation
-      statement_timeout: 30000,
-      query_timeout: 30000,
-      // Connection validation query
-      validationQuery: 'SELECT 1',
-      // Validate connection on checkout
-      validateConnection: true,
+      // Pool sizing
+      max: poolMax,
+      min: poolMin,
+
+      // Connection lifecycle
+      idleTimeoutMillis: idleTimeout,
+      connectionTimeoutMillis: connectionTimeout,
+
+      // Query protection
+      statement_timeout: statementTimeout,
+      query_timeout: statementTimeout,
+
+      // Keep-alive to detect dead connections early
+      keepAlive: true,
+      keepAliveInitialDelayMillis: 10000,
+
+      // Application name for pg_stat_activity visibility
+      application_name: `nestera_${nodeEnv}`,
+
+      // Allow recovery from full pool by queuing at most this many requests
+      maxWaitingClients: Math.ceil(poolMax * 0.5),
+
+      // Validate connections before checkout to discard stale ones
+      testOnBorrow: true,
     },
   };
 }
diff --git a/backend/src/common/filters/validation-exception.filter.ts b/backend/src/common/filters/validation-exception.filter.ts
new file mode 100644
index 000000000..766c136df
--- /dev/null
+++ b/backend/src/common/filters/validation-exception.filter.ts
@@ -0,0 +1,110 @@
+import {
+  ExceptionFilter,
+  Catch,
+  ArgumentsHost,
+  BadRequestException,
+  Logger,
+} from '@nestjs/common';
+import { Request, Response } from 'express';
+
+interface ValidationError {
+  field: string;
+  value?: unknown;
+  constraints: Record<string, string>;
+  children?: ValidationError[];
+}
+
+interface ClassValidatorError {
+  property: string;
+  value?: unknown;
+  constraints?: Record<string, string>;
+  children?: ClassValidatorError[];
+}
+
+@Catch(BadRequestException)
+export class ValidationExceptionFilter implements ExceptionFilter {
+  private readonly logger = new Logger(ValidationExceptionFilter.name);
+
+  catch(exception: BadRequestException, host: ArgumentsHost): void {
+    const ctx = host.switchToHttp();
+    const response = ctx.getResponse<Response>();
+    const request = ctx.getRequest<Request>();
+
+    const exceptionResponse = exception.getResponse() as
+      | string
+      | { message: string | string[] | ClassValidatorError[]; error?: string };
+
+    const statusCode = exception.getStatus();
+    const correlationId = (request as any).correlationId;
+
+    let formattedErrors: ValidationError[] | string[];
+    let message: string;
+
+    if (typeof exceptionResponse === 'string') {
+      message = exceptionResponse;
+      formattedErrors = [exceptionResponse];
+    } else if (Array.isArray(exceptionResponse.message)) {
+      const msgArray = exceptionResponse.message;
+
+      if (msgArray.length > 0 && typeof msgArray[0] === 'object') {
+        const classValidatorErrors = msgArray as ClassValidatorError[];
+        formattedErrors = this.formatClassValidatorErrors(classValidatorErrors);
+        message = 'Validation failed';
+      } else {
+        formattedErrors = msgArray as string[];
+        message = 'Validation failed';
+      }
+    } else {
+      message =
+        typeof exceptionResponse.message === 'string'
+          ? exceptionResponse.message
+          : 'Bad Request';
+      formattedErrors = [message];
+    }
+
+    const body = {
+      success: false,
+      statusCode,
+      error: 'Validation Error',
+      message,
+      errors: formattedErrors,
+      timestamp: new Date().toISOString(),
+      path: request.url,
+      correlationId,
+    };
+
+    this.logger.debug(
+      `Validation error on ${request.method} ${request.url}: ${JSON.stringify(formattedErrors)}`,
+    );
+
+    response.status(statusCode).json(body);
+  }
+
+  private formatClassValidatorErrors(
+    errors: ClassValidatorError[],
+    parentField = '',
+  ): ValidationError[] {
+    const result: ValidationError[] = [];
+
+    for (const error of errors) {
+      const field = parentField
+        ? `${parentField}.${error.property}`
+        : error.property;
+
+      if (error.constraints && Object.keys(error.constraints).length > 0) {
+        result.push({
+          field,
+          value: error.value,
+          constraints: error.constraints,
+        });
+      }
+
+      if (error.children && error.children.length > 0) {
+        const childErrors = this.formatClassValidatorErrors(error.children, field);
+        result.push(...childErrors);
+      }
+    }
+
+    return result;
+  }
+}
diff --git a/backend/src/common/middleware/validation.middleware.ts b/backend/src/common/middleware/validation.middleware.ts
new file mode 100644
index 000000000..5fce9067b
--- /dev/null
+++ b/backend/src/common/middleware/validation.middleware.ts
@@ -0,0 +1,120 @@
+import {
+  Injectable,
+  NestMiddleware,
+  BadRequestException,
+  PayloadTooLargeException,
+  UnsupportedMediaTypeException,
+  Logger,
+} from '@nestjs/common';
+import { Request, Response, NextFunction } from 'express';
+
+const ALLOWED_CONTENT_TYPES = [
+  'application/json',
+  'application/x-www-form-urlencoded',
+  'multipart/form-data',
+  'text/plain',
+];
+
+const MAX_BODY_SIZE_BYTES = 10 * 1024 * 1024; // 10 MB
+
+const DANGEROUS_PATTERNS = [
+  /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,
+  /javascript:/gi,
+  /on\w+\s*=/gi,
+];
+
+@Injectable()
+export class RequestValidationMiddleware implements NestMiddleware {
+  private readonly logger = new Logger(RequestValidationMiddleware.name);
+
+  use(req: Request, res: Response, next: NextFunction): void {
+    try {
+      this.validateContentType(req);
+      this.validateContentLength(req);
+      this.validateQueryParams(req);
+      this.validateHeaders(req);
+      next();
+    } catch (error) {
+      next(error);
+    }
+  }
+
+  private validateContentType(req: Request): void {
+    if (!['POST', 'PUT', 'PATCH'].includes(req.method)) return;
+
+    const contentType = req.headers['content-type'];
+    if (!contentType) return;
+
+    const baseType = contentType.split(';')[0].trim().toLowerCase();
+    const isAllowed = ALLOWED_CONTENT_TYPES.some((allowed) =>
+      baseType.startsWith(allowed),
+    );
+
+    if (!isAllowed) {
+      throw new UnsupportedMediaTypeException(
+        `Content-Type '${baseType}' is not supported. Allowed types: ${ALLOWED_CONTENT_TYPES.join(', ')}`,
+      );
+    }
+  }
+
+  private validateContentLength(req: Request): void {
+    const contentLength = req.headers['content-length'];
+    if (!contentLength) return;
+
+    const size = parseInt(contentLength, 10);
+    if (isNaN(size)) return;
+
+    if (size > MAX_BODY_SIZE_BYTES) {
+      throw new PayloadTooLargeException(
+        `Request body too large. Maximum allowed size is ${MAX_BODY_SIZE_BYTES / 1024 / 1024}MB`,
+      );
+    }
+  }
+
+  private validateQueryParams(req: Request): void {
+    const query = req.query;
+
+    for (const [key, value] of Object.entries(query)) {
+      if (typeof value === 'string') {
+        this.checkForDangerousContent(key, value);
+
+        if (value.length > 1000) {
+          throw new BadRequestException(
+            `Query parameter '${key}' exceeds maximum length of 1000 characters`,
+          );
+        }
+      }
+    }
+  }
+
+  private validateHeaders(req: Request): void {
+    const suspiciousHeaders = ['x-forwarded-for', 'x-real-ip'];
+
+    for (const header of suspiciousHeaders) {
+      const value = req.headers[header];
+      if (typeof value === 'string' && value.length > 512) {
+        this.logger.warn(`Oversized header '${header}' from ${req.ip}`);
+      }
+    }
+
+    // Reject requests with null bytes in any header
+    for (const [name, value] of Object.entries(req.headers)) {
+      const headerStr = Array.isArray(value) ? value.join(',') : (value as string);
+      if (headerStr && headerStr.includes('\0')) {
+        throw new BadRequestException(`Invalid character in header '${name}'`);
+      }
+    }
+  }
+
+  private checkForDangerousContent(field: string, value: string): void {
+    for (const pattern of DANGEROUS_PATTERNS) {
+      pattern.lastIndex = 0;
+      if (pattern.test(value)) {
+        this.logger.warn(`Potentially dangerous content in field '${field}'`);
+        throw new BadRequestException(
+          `Query parameter '${field}' contains invalid content`,
+        );
+      }
+    }
+  }
+}
diff --git a/backend/src/common/validators/is-iso-date.validator.ts b/backend/src/common/validators/is-iso-date.validator.ts
new file mode 100644
index 000000000..93b6df6b1
--- /dev/null
+++ b/backend/src/common/validators/is-iso-date.validator.ts
@@ -0,0 +1,52 @@
+import {
+  registerDecorator,
+  ValidationOptions,
+  ValidationArguments,
+} from 'class-validator';
+
+export function IsISODate(validationOptions?: ValidationOptions) {
+  return function (object: object, propertyName: string) {
+    registerDecorator({
+      name: 'isISODate',
+      target: object.constructor,
+      propertyName,
+      options: validationOptions,
+      validator: {
+        validate(value: unknown): boolean {
+          if (typeof value !== 'string') return false;
+          const date = new Date(value);
+          return !isNaN(date.getTime()) && value === date.toISOString().split('T')[0] ||
+            /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/.test(value);
+        },
+        defaultMessage(args: ValidationArguments): string {
+          return `${args.property} must be a valid ISO 8601 date string (YYYY-MM-DD or YYYY-MM-DDTHH:mm:ssZ)`;
+        },
+      },
+    });
+  };
+}
+
+export function IsDateRange(
+  startField: string,
+  validationOptions?: ValidationOptions,
+) {
+  return function (object: object, propertyName: string) {
+    registerDecorator({
+      name: 'isDateRange',
+      target: object.constructor,
+      propertyName,
+      options: validationOptions,
+      constraints: [startField],
+      validator: {
+        validate(value: unknown, args: ValidationArguments): boolean {
+          const startValue = (args.object as Record<string, unknown>)[args.constraints[0]];
+          if (!value || !startValue) return true;
+          return new Date(value as string) >= new Date(startValue as string);
+        },
+        defaultMessage(args: ValidationArguments): string {
+          return `${args.property} must be after or equal to ${args.constraints[0]}`;
+        },
+      },
+    });
+  };
+}
diff --git a/backend/src/common/validators/is-positive-amount.validator.ts b/backend/src/common/validators/is-positive-amount.validator.ts
new file mode 100644
index 000000000..612dda722
--- /dev/null
+++ b/backend/src/common/validators/is-positive-amount.validator.ts
@@ -0,0 +1,69 @@
+import {
+  registerDecorator,
+  ValidationOptions,
+  ValidationArguments,
+} from 'class-validator';
+
+export function IsPositiveAmount(validationOptions?: ValidationOptions) {
+  return function (object: object, propertyName: string) {
+    registerDecorator({
+      name: 'isPositiveAmount',
+      target: object.constructor,
+      propertyName,
+      options: validationOptions,
+      validator: {
+        validate(value: unknown): boolean {
+          const num = typeof value === 'string' ? parseFloat(value) : Number(value);
+          return isFinite(num) && num > 0;
+        },
+        defaultMessage(args: ValidationArguments): string {
+          return `${args.property} must be a positive number`;
+        },
+      },
+    });
+  };
+}
+
+export function IsUSDCAmount(validationOptions?: ValidationOptions) {
+  return function (object: object, propertyName: string) {
+    registerDecorator({
+      name: 'isUSDCAmount',
+      target: object.constructor,
+      propertyName,
+      options: validationOptions,
+      validator: {
+        validate(value: unknown): boolean {
+          const num = typeof value === 'string' ? parseFloat(value) : Number(value);
+          if (!isFinite(num) || num <= 0) return false;
+          // USDC uses 7 decimal places on Stellar
+          const strVal = String(value);
+          const decimalPart = strVal.split('.')[1] || '';
+          return decimalPart.length <= 7;
+        },
+        defaultMessage(args: ValidationArguments): string {
+          return `${args.property} must be a positive USDC amount with at most 7 decimal places`;
+        },
+      },
+    });
+  };
+}
+
+export function IsNonNegativeAmount(validationOptions?: ValidationOptions) {
+  return function (object: object, propertyName: string) {
+    registerDecorator({
+      name: 'isNonNegativeAmount',
+      target: object.constructor,
+      propertyName,
+      options: validationOptions,
+      validator: {
+        validate(value: unknown): boolean {
+          const num = typeof value === 'string' ? parseFloat(value) : Number(value);
+          return isFinite(num) && num >= 0;
+        },
+        defaultMessage(args: ValidationArguments): string {
+          return `${args.property} must be a non-negative number`;
+        },
+      },
+    });
+  };
+}
diff --git a/backend/src/common/validators/is-uuid.validator.ts b/backend/src/common/validators/is-uuid.validator.ts
new file mode 100644
index 000000000..f2104a63d
--- /dev/null
+++ b/backend/src/common/validators/is-uuid.validator.ts
@@ -0,0 +1,27 @@
+import {
+  registerDecorator,
+  ValidationOptions,
+  ValidationArguments,
+} from 'class-validator';
+
+const UUID_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+export function IsUUID(validationOptions?: ValidationOptions) {
+  return function (object: object, propertyName: string) {
+    registerDecorator({
+      name: 'isUUID',
+      target: object.constructor,
+      propertyName,
+      options: validationOptions,
+      validator: {
+        validate(value: unknown): boolean {
+          return typeof value === 'string' && UUID_PATTERN.test(value);
+        },
+        defaultMessage(args: ValidationArguments): string {
+          return `${args.property} must be a valid UUID (v1-v5)`;
+        },
+      },
+    });
+  };
+}
diff --git a/backend/src/main.ts b/backend/src/main.ts
index 7f2921d16..febe63d6d 100644
--- a/backend/src/main.ts
+++ b/backend/src/main.ts
@@ -6,6 +6,7 @@ import * as helmet from 'helmet';
 import * as compression from 'compression';
 import { AppModule } from './app.module';
 import { AllExceptionsFilter } from './common/filters/http-exception.filter';
+import { ValidationExceptionFilter } from './common/filters/validation-exception.filter';
 import { SwaggerModule, DocumentBuilder } from '@nestjs/swagger';
 import {
   VersioningMiddleware,
@@ -66,12 +67,17 @@ async function bootstrap() {
   const versionAnalytics = app.get(VersionAnalyticsService);
   app.useGlobalInterceptors(new VersionAnalyticsInterceptor(versionAnalytics));
 
-  app.useGlobalFilters(new AllExceptionsFilter());
+  // Filters applied in reverse order; ValidationExceptionFilter handles BadRequestException first
+  app.useGlobalFilters(new AllExceptionsFilter(), new ValidationExceptionFilter());
   app.useGlobalPipes(
     new ValidationPipe({
       whitelist: true,
       forbidNonWhitelisted: true,
       transform: true,
+      exceptionFactory: (errors) => {
+        const { BadRequestException } = require('@nestjs/common');
+        return new BadRequestException(errors);
+      },
     }),
   );
 
diff --git a/backend/src/modules/apm/apm.controller.ts b/backend/src/modules/apm/apm.controller.ts
new file mode 100644
index 000000000..af914a1b8
--- /dev/null
+++ b/backend/src/modules/apm/apm.controller.ts
@@ -0,0 +1,101 @@
+import {
+  Controller,
+  Get,
+  Query,
+  Param,
+  Header,
+  UseGuards,
+} from '@nestjs/common';
+import {
+  ApiTags,
+  ApiOperation,
+  ApiResponse,
+  ApiBearerAuth,
+  ApiQuery,
+} from '@nestjs/swagger';
+import { ApmService } from './apm.service';
+import { MetricsService } from './metrics.service';
+import { DistributedTracingService } from './distributed-tracing.service';
+import { JwtAuthGuard } from '../../auth/guards/jwt-auth.guard';
+
+@ApiTags('APM')
+@Controller('apm')
+export class ApmController {
+  constructor(
+    private readonly apmService: ApmService,
+    private readonly metricsService: MetricsService,
+    private readonly tracingService: DistributedTracingService,
+  ) {}
+
+  @Get('metrics')
+  @Header('Content-Type', 'text/plain; version=0.0.4; charset=utf-8')
+  @ApiOperation({ summary: 'Prometheus-compatible metrics endpoint' })
+  @ApiResponse({ status: 200, description: 'Metrics in Prometheus text format' })
+  getPrometheusMetrics(): string {
+    return this.metricsService.getMetricsAsPrometheusText();
+  }
+
+  @Get('dashboard')
+  @UseGuards(JwtAuthGuard)
+  @ApiBearerAuth('access-token')
+  @ApiOperation({ summary: 'APM dashboard overview' })
+  @ApiResponse({ status: 200, description: 'Dashboard data with metrics, errors, and traces' })
+  getDashboard() {
+    return this.apmService.getDashboardData();
+  }
+
+  @Get('errors')
+  @UseGuards(JwtAuthGuard)
+  @ApiBearerAuth('access-token')
+  @ApiOperation({ summary: 'Error tracking summary' })
+  @ApiQuery({ name: 'limit', required: false, type: Number, description: 'Number of errors to return' })
+  getErrors(@Query('limit') limit = 50) {
+    return {
+      errors: this.apmService.getErrorSummary().slice(0, Number(limit)),
+      topErrors: this.apmService.getTopErrors(10),
+    };
+  }
+
+  @Get('traces')
+  @UseGuards(JwtAuthGuard)
+  @ApiBearerAuth('access-token')
+  @ApiOperation({ summary: 'Recent distributed traces' })
+  @ApiQuery({ name: 'limit', required: false, type: Number })
+  getTraces(@Query('limit') limit = 100) {
+    return {
+      active: this.tracingService.getActiveSpans(),
+      recent: this.tracingService.getRecentSpans(Number(limit)),
+      stats: this.tracingService.getTracingStats(),
+    };
+  }
+
+  @Get('traces/:traceId')
+  @UseGuards(JwtAuthGuard)
+  @ApiBearerAuth('access-token')
+  @ApiOperation({ summary: 'Get spans for a specific trace' })
+  getTrace(@Param('traceId') traceId: string) {
+    return {
+      traceId,
+      spans: this.tracingService.getTraceById(traceId),
+    };
+  }
+
+  @Get('alerts')
+  @UseGuards(JwtAuthGuard)
+  @ApiBearerAuth('access-token')
+  @ApiOperation({ summary: 'Alert rules and recent fired alerts' })
+  getAlerts(@Query('limit') limit = 50) {
+    return {
+      rules: this.apmService.getAlertRules(),
+      history: this.apmService.getAlertHistory(Number(limit)),
+    };
+  }
+
+  @Get('metrics/summary')
+  @UseGuards(JwtAuthGuard)
+  @ApiBearerAuth('access-token')
+  @ApiOperation({ summary: 'JSON metrics summary with percentiles' })
+  getMetricsSummary() {
+    return this.metricsService.getMetricsSummary();
+  }
+}
diff --git a/backend/src/modules/apm/apm.interceptor.ts b/backend/src/modules/apm/apm.interceptor.ts
new file mode 100644
index 000000000..5364bacd9
--- /dev/null
+++ b/backend/src/modules/apm/apm.interceptor.ts
@@ -0,0 +1,85 @@
+import {
+  Injectable,
+  NestInterceptor,
+  ExecutionContext,
+  CallHandler,
+} from '@nestjs/common';
+import { Observable } from 'rxjs';
+import { tap, catchError } from 'rxjs/operators';
+import { Request, Response } from 'express';
+import { ApmService } from './apm.service';
+import { DistributedTracingService } from './distributed-tracing.service';
+
+@Injectable()
+export class ApmInterceptor implements NestInterceptor {
+  constructor(
+    private readonly apmService: ApmService,
+    private readonly tracingService: DistributedTracingService,
+  ) {}
+
+  intercept(context: ExecutionContext, next: CallHandler): Observable<any> {
+    const request = context.switchToHttp().getRequest<Request>();
+    const response = context.switchToHttp().getResponse<Response>();
+    const startTime = Date.now();
+
+    const incomingContext = this.tracingService.parseTraceContext(
+      request.headers as Record<string, string | string[] | undefined>,
+    );
+    const traceCtx = this.tracingService.createTraceContext(
+      incomingContext || undefined,
+    );
+
+    const span = this.tracingService.startSpan(
+      `HTTP ${request.method} ${request.path}`,
+      traceCtx,
+      {
+        'http.method': request.method,
+        'http.url': request.url,
+        'http.route': request.path,
+        'http.user_agent': (request.headers['user-agent'] as string) || '',
+        'component': 'http',
+      },
+    );
+
+    response.setHeader('traceparent', this.tracingService.buildTraceparentHeader(traceCtx));
+    response.setHeader('X-Trace-Id', traceCtx.traceId);
+    (request as any).traceContext = traceCtx;
+    (request as any).apmSpan = span;
+
+    const route = this.getRoutePattern(request);
+
+    return next.handle().pipe(
+      tap(() => {
+        const duration = Date.now() - startTime;
+        const statusCode = response.statusCode;
+
+        this.tracingService.addSpanTag(span, 'http.status_code', statusCode);
+        this.tracingService.finishSpan(span);
+        this.apmService.trackHttpRequest(request.method, route, statusCode, duration);
+      }),
+      catchError((error: Error) => {
+        const duration = Date.now() - startTime;
+        const statusCode = (error as any).status || 500;
+
+        this.tracingService.finishSpan(span, error);
+        this.apmService.trackHttpRequest(request.method, route, statusCode, duration);
+        this.apmService.trackError(error, {
+          route,
+          method: request.method,
+          statusCode,
+          traceId: traceCtx.traceId,
+        });
+
+        throw error;
+      }),
+    );
+  }
+
+  private getRoutePattern(request: Request): string {
+    const route = (request as any).route;
+    if (route?.path) {
+      return request.path.replace(/\/[0-9a-f-]{36}/gi, '/:id').replace(/\/\d+/g, '/:id');
+    }
+    return request.path;
+  }
+}
diff --git a/backend/src/modules/apm/apm.module.ts b/backend/src/modules/apm/apm.module.ts
new file mode 100644
index 000000000..1622fcb19
--- /dev/null
+++ b/backend/src/modules/apm/apm.module.ts
@@ -0,0 +1,14 @@
+import { Module, Global } from '@nestjs/common';
+import { ApmService } from './apm.service';
+import { MetricsService } from './metrics.service';
+import { DistributedTracingService } from './distributed-tracing.service';
+import { ApmController } from './apm.controller';
+import { ApmInterceptor } from './apm.interceptor';
+
+@Global()
+@Module({
+  controllers: [ApmController],
+  providers: [ApmService, MetricsService, DistributedTracingService, ApmInterceptor],
+  exports: [ApmService, MetricsService, DistributedTracingService, ApmInterceptor],
+})
+export class ApmModule {}
diff --git a/backend/src/modules/apm/apm.service.ts b/backend/src/modules/apm/apm.service.ts
new file mode 100644
index 000000000..4eaa14862
--- /dev/null
+++ b/backend/src/modules/apm/apm.service.ts
@@ -0,0 +1,260 @@
+import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { MetricsService } from './metrics.service';
+import { DistributedTracingService, TraceContext } from './distributed-tracing.service';
+
+export interface ErrorEvent {
+  id: string;
+  message: string;
+  stack?: string;
+  type: string;
+  route?: string;
+  method?: string;
+  statusCode?: number;
+  userId?: string;
+  traceId?: string;
+  timestamp: Date;
+  count: number;
+}
+
+export interface AlertRule {
+  name: string;
+  metric: string;
+  condition: 'gt' | 'lt' | 'eq';
+  threshold: number;
+  windowMinutes: number;
+  severity: 'info' | 'warning' | 'critical';
+  enabled: boolean;
+}
+
+@Injectable()
+export class ApmService implements OnModuleInit {
+  private readonly logger = new Logger(ApmService.name);
+  private readonly errorRegistry = new Map<string, ErrorEvent>();
+  private readonly alertRules: AlertRule[] = [];
+  private readonly alertHistory: Array<{
+    rule: string;
+    value: number;
+    timestamp: Date;
+    severity: string;
+  }> = [];
+
+  constructor(
+    private readonly metricsService: MetricsService,
+    private readonly tracingService: DistributedTracingService,
+    private readonly configService: ConfigService,
+  ) {}
+
+  onModuleInit() {
+    this.setupDefaultAlertRules();
+    this.startAlertEvaluationLoop();
+  }
+
+  private setupDefaultAlertRules() {
+    this.alertRules.push(
+      {
+        name: 'high_error_rate',
+        metric: 'errors_total',
+        condition: 'gt',
+        threshold: 50,
+        windowMinutes: 5,
+        severity: 'critical',
+        enabled: true,
+      },
+      {
+        name: 'slow_response_time',
+        metric: 'http_request_duration_seconds',
+        condition: 'gt',
+        threshold: 2.0,
+        windowMinutes: 5,
+        severity: 'warning',
+        enabled: true,
+      },
+      {
+        name: 'high_db_pool_usage',
+        metric: 'db_pool_active_connections',
+        condition: 'gt',
+        threshold: 25,
+        windowMinutes: 1,
+        severity: 'warning',
+        enabled: true,
+      },
+    );
+  }
+
+  private startAlertEvaluationLoop() {
+    setInterval(() => {
+      this.evaluateAlerts();
+    }, 60_000);
+  }
+
+  private evaluateAlerts() {
+    const summary = this.metricsService.getMetricsSummary();
+
+    for (const rule of this.alertRules) {
+      if (!rule.enabled) continue;
+
+      const metricData = summary[rule.metric] as
+        | { values: Record<string, number> }
+        | undefined;
+      if (!metricData) continue;
+
+      const values = Object.values(metricData.values || {}) as number[];
+      if (values.length === 0) continue;
+
+      const total = values.reduce((a, b) => a + b, 0);
+      let triggered = false;
+
+      if (rule.condition === 'gt' && total > rule.threshold) triggered = true;
+      if (rule.condition === 'lt' && total < rule.threshold) triggered = true;
+      if (rule.condition === 'eq' && total === rule.threshold) triggered = true;
+
+      if (triggered) {
+        this.triggerAlert(rule, total);
+      }
+    }
+  }
+
+  private triggerAlert(rule: AlertRule, value: number) {
+    const entry = {
+      rule: rule.name,
+      value,
+      timestamp: new Date(),
+      severity: rule.severity,
+    };
+
+    this.alertHistory.push(entry);
+    if (this.alertHistory.length > 1000) this.alertHistory.shift();
+
+    this.logger.warn(
+      `[ALERT][${rule.severity.toUpperCase()}] ${rule.name}: ${rule.metric} is ${value} (threshold: ${rule.threshold})`,
+      entry,
+    );
+  }
+
+  trackError(
+    error: Error,
+    context: { route?: string; method?: string; statusCode?: number; userId?: string; traceId?: string },
+  ): void {
+    const key = `${error.constructor.name}:${error.message}`;
+    const existing = this.errorRegistry.get(key);
+
+    if (existing) {
+      existing.count++;
+      existing.timestamp = new Date();
+    } else {
+      this.errorRegistry.set(key, {
+        id: key,
+        message: error.message,
+        stack: error.stack,
+        type: error.constructor.name,
+        route: context.route,
+        method: context.method,
+        statusCode: context.statusCode,
+        userId: context.userId,
+        traceId: context.traceId,
+        timestamp: new Date(),
+        count: 1,
+      });
+    }
+
+    this.metricsService.incrementCounter('errors_total', {
+      type: error.constructor.name,
+      route: context.route || 'unknown',
+      status_code: String(context.statusCode || 500),
+    });
+  }
+
+  trackHttpRequest(
+    method: string,
+    route: string,
+    statusCode: number,
+    durationMs: number,
+  ): void {
+    const labels = { method, route, status_code: String(statusCode) };
+    this.metricsService.incrementCounter('http_requests_total', labels);
+    this.metricsService.recordHistogram(
+      'http_request_duration_seconds',
+      durationMs / 1000,
+      labels,
+    );
+  }
+
+  trackUserRegistration(method: 'email' | 'oauth' | 'wallet'): void {
+    this.metricsService.incrementCounter('user_registrations_total', { method });
+  }
+
+  trackUserLogin(status: 'success' | 'failure' | '2fa_required'): void {
+    this.metricsService.incrementCounter('user_logins_total', { status });
+  }
+
+  trackSavingsSubscription(productType: string, status: 'created' | 'activated' | 'cancelled'): void {
+    this.metricsService.incrementCounter('savings_subscriptions_total', {
+      product_type: productType,
+      status,
+    });
+  }
+
+  trackTransaction(type: string, status: 'pending' | 'completed' | 'failed', amountUsdc?: number): void {
+    this.metricsService.incrementCounter('transactions_total', { type, status });
+    if (amountUsdc !== undefined) {
+      this.metricsService.recordHistogram('transaction_amount_usdc', amountUsdc, { type });
+    }
+  }
+
+  trackDbQuery(operation: string, entity: string, durationMs: number): void {
+    this.metricsService.recordHistogram('db_query_duration_seconds', durationMs / 1000, {
+      operation,
+      entity,
+    });
+  }
+
+  updateDbPoolMetrics(active: number, idle: number): void {
+    this.metricsService.setGauge('db_pool_active_connections', active);
+    this.metricsService.setGauge('db_pool_idle_connections', idle);
+  }
+
+  trackTokenRefresh(status: 'success' | 'failure'): void {
+    this.metricsService.incrementCounter('auth_token_refresh_total', { status });
+  }
+
+  trackKycVerification(status: 'approved' | 'rejected' | 'pending'): void {
+    this.metricsService.incrementCounter('kyc_verifications_total', { status });
+  }
+
+  getErrorSummary(): ErrorEvent[] {
+    return Array.from(this.errorRegistry.values())
+      .sort((a, b) => b.count - a.count)
+      .slice(0, 100);
+  }
+
+  getTopErrors(limit = 10): ErrorEvent[] {
+    return Array.from(this.errorRegistry.values())
+      .sort((a, b) => b.count - a.count)
+      .slice(0, limit);
+  }
+
+  getAlertHistory(limit = 50): typeof this.alertHistory {
+    return this.alertHistory.slice(-limit);
+  }
+
+  getAlertRules(): AlertRule[] {
+    return this.alertRules;
+  }
+
+  getDashboardData() {
+    return {
+      metrics: this.metricsService.getMetricsSummary(),
+      errors: {
+        total: Array.from(this.errorRegistry.values()).reduce((a, e) => a + e.count, 0),
+        uniqueTypes: this.errorRegistry.size,
+        top: this.getTopErrors(),
+      },
+      tracing: this.tracingService.getTracingStats(),
+      alerts: {
+        rules: this.alertRules.filter((r) => r.enabled).length,
+        recentFired: this.alertHistory.slice(-10),
+      },
+    };
+  }
+}
diff --git a/backend/src/modules/apm/distributed-tracing.service.ts b/backend/src/modules/apm/distributed-tracing.service.ts
new file mode 100644
index 000000000..2c2750f90
--- /dev/null
+++ b/backend/src/modules/apm/distributed-tracing.service.ts
@@ -0,0 +1,205 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { v4 as uuidv4 } from 'uuid';
+
+export interface TraceContext {
+  traceId: string;
+  spanId: string;
+  parentSpanId?: string;
+  sampled: boolean;
+  baggage: Record<string, string>;
+}
+
+export interface Span {
+  traceId: string;
+  spanId: string;
+  parentSpanId?: string;
+  operationName: string;
+  startTime: number;
+  endTime?: number;
+  duration?: number;
+  tags: Record<string, string | number | boolean>;
+  logs: Array<{ timestamp: number; message: string; fields?: Record<string, unknown> }>;
+  status: 'active' | 'completed' | 'error';
+  error?: string;
+}
+
+@Injectable()
+export class DistributedTracingService {
+  private readonly logger = new Logger(DistributedTracingService.name);
+  private readonly activeSpans = new Map<string, Span>();
+  private readonly completedSpans: Span[] = [];
+  private readonly maxCompletedSpans = 10000;
+  private readonly samplingRate: number;
+
+  constructor() {
+    this.samplingRate = parseFloat(process.env.APM_SAMPLING_RATE || '1.0');
+  }
+
+  parseTraceContext(headers: Record<string, string | string[] | undefined>): TraceContext | null {
+    // W3C Trace Context format: traceparent header
+    const traceparent = headers['traceparent'] as string;
+    if (traceparent) {
+      return this.parseTraceparent(traceparent, headers);
+    }
+
+    // DataDog format: x-datadog-trace-id, x-datadog-parent-id
+    const ddTraceId = headers['x-datadog-trace-id'] as string;
+    if (ddTraceId) {
+      return {
+        traceId: ddTraceId,
+        spanId: (headers['x-datadog-parent-id'] as string) || this.generateSpanId(),
+        sampled: (headers['x-datadog-sampling-priority'] as string) !== '0',
+        baggage: {},
+      };
+    }
+
+    return null;
+  }
+
+  private parseTraceparent(
+    traceparent: string,
+    headers: Record<string, string | string[] | undefined>,
+  ): TraceContext | null {
+    const parts = traceparent.split('-');
+    if (parts.length !== 4) return null;
+
+    const [, traceId, parentId, flags] = parts;
+    const sampled = (parseInt(flags, 16) & 1) === 1;
+
+    const baggage: Record<string, string> = {};
+    const tracestateHeader = headers['tracestate'] as string;
+    if (tracestateHeader) {
+      tracestateHeader.split(',').forEach((entry) => {
+        const [k, v] = entry.split('=');
+        if (k && v) baggage[k.trim()] = v.trim();
+      });
+    }
+
+    return { traceId, spanId: parentId, sampled, baggage };
+  }
+
+  createTraceContext(parentContext?: TraceContext): TraceContext {
+    const sampled = Math.random() < this.samplingRate;
+    return {
+      traceId: parentContext?.traceId || this.generateTraceId(),
+      spanId: this.generateSpanId(),
+      parentSpanId: parentContext?.spanId,
+      sampled: parentContext?.sampled ?? sampled,
+      baggage: { ...(parentContext?.baggage || {}) },
+    };
+  }
+
+  startSpan(
+    operationName: string,
+    context: TraceContext,
+    tags: Record<string, string | number | boolean> = {},
+  ): Span {
+    const span: Span = {
+      traceId: context.traceId,
+      spanId: context.spanId,
+      parentSpanId: context.parentSpanId,
+      operationName,
+      startTime: Date.now(),
+      tags,
+      logs: [],
+      status: 'active',
+    };
+
+    if (context.sampled) {
+      this.activeSpans.set(span.spanId, span);
+    }
+
+    return span;
+  }
+
+  finishSpan(span: Span, error?: Error): void {
+    span.endTime = Date.now();
+    span.duration = span.endTime - span.startTime;
+
+    if (error) {
+      span.status = 'error';
+      span.error = error.message;
+      span.tags['error'] = true;
+      span.tags['error.message'] = error.message;
+      span.tags['error.type'] = error.constructor.name;
+      span.logs.push({
+        timestamp: Date.now(),
+        message: 'error',
+        fields: { 'error.object': error.message, stack: error.stack },
+      });
+    } else {
+      span.status = 'completed';
+    }
+
+    this.activeSpans.delete(span.spanId);
+    this.completedSpans.push(span);
+
+    if (this.completedSpans.length > this.maxCompletedSpans) {
+      this.completedSpans.shift();
+    }
+
+    if (span.duration && span.duration > 1000) {
+      this.logger.warn(
+        `Slow span detected: ${operationName} took ${span.duration}ms`,
+        { traceId: span.traceId, spanId: span.spanId, operationName: span.operationName },
+      );
+    }
+  }
+
+  addSpanTag(span: Span, key: string, value: string | number | boolean): void {
+    span.tags[key] = value;
+  }
+
+  addSpanLog(span: Span, message: string, fields?: Record<string, unknown>): void {
+    span.logs.push({ timestamp: Date.now(), message, fields });
+  }
+
+  buildTraceparentHeader(context: TraceContext): string {
+    const flags = context.sampled ? '01' : '00';
+    return `00-${context.traceId}-${context.spanId}-${flags}`;
+  }
+
+  getActiveSpans(): Span[] {
+    return Array.from(this.activeSpans.values());
+  }
+
+  getRecentSpans(limit = 100): Span[] {
+    return this.completedSpans.slice(-limit);
+  }
+
+  getTraceById(traceId: string): Span[] {
+    const active = Array.from(this.activeSpans.values()).filter(
+      (s) => s.traceId === traceId,
+    );
+    const completed = this.completedSpans.filter((s) => s.traceId === traceId);
+    return [...active, ...completed];
+  }
+
+  getTracingStats() {
+    const completed = this.completedSpans;
+    const errorSpans = completed.filter((s) => s.status === 'error');
+    const durations = completed.map((s) => s.duration || 0).filter((d) => d > 0);
+    const sorted = [...durations].sort((a, b) => a - b);
+
+    return {
+      activeSpans: this.activeSpans.size,
+      totalCompletedSpans: completed.length,
+      errorRate:
+        completed.length > 0 ? errorSpans.length / completed.length : 0,
+      avgDurationMs:
+        durations.length > 0
+          ? durations.reduce((a, b) => a + b, 0) / durations.length
+          : 0,
+      p95DurationMs: sorted[Math.floor(sorted.length * 0.95)] || 0,
+      p99DurationMs: sorted[Math.floor(sorted.length * 0.99)] || 0,
+    };
+  }
+
+  private generateTraceId(): string {
+    return uuidv4().replace(/-/g, '');
+  }
+
+  private generateSpanId(): string {
+    return uuidv4().replace(/-/g, '').substring(0, 16);
+  }
+}
diff --git a/backend/src/modules/apm/metrics.service.ts b/backend/src/modules/apm/metrics.service.ts
new file mode 100644
index 000000000..4eb293908
--- /dev/null
+++ b/backend/src/modules/apm/metrics.service.ts
@@ -0,0 +1,279 @@
+import { Injectable, OnModuleInit, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+
+export interface MetricLabels {
+  [key: string]: string | number;
+}
+
+export interface CounterMetric {
+  name: string;
+  help: string;
+  labels: string[];
+}
+
+export interface HistogramMetric {
+  name: string;
+  help: string;
+  labels: string[];
+  buckets: number[];
+}
+
+export interface GaugeMetric {
+  name: string;
+  help: string;
+  labels: string[];
+}
+
+interface StoredMetric {
+  type: 'counter' | 'histogram' | 'gauge';
+  name: string;
+  help: string;
+  labels: string[];
+  values: Map<string, number | number[]>;
+  buckets?: number[];
+}
+
+@Injectable()
+export class MetricsService implements OnModuleInit {
+  private readonly logger = new Logger(MetricsService.name);
+  private readonly metrics = new Map<string, StoredMetric>();
+  private readonly defaultBuckets = [
+    0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10,
+  ];
+
+  constructor(private configService: ConfigService) {}
+
+  onModuleInit() {
+    this.registerDefaultMetrics();
+  }
+
+  private registerDefaultMetrics() {
+    // HTTP request metrics
+    this.registerCounter({
+      name: 'http_requests_total',
+      help: 'Total number of HTTP requests',
+      labels: ['method', 'route', 'status_code'],
+    });
+
+    this.registerHistogram({
+      name: 'http_request_duration_seconds',
+      help: 'Duration of HTTP requests in seconds',
+      labels: ['method', 'route', 'status_code'],
+      buckets: this.defaultBuckets,
+    });
+
+    // Business metrics
+    this.registerCounter({
+      name: 'user_registrations_total',
+      help: 'Total number of user registrations',
+      labels: ['method'],
+    });
+
+    this.registerCounter({
+      name: 'user_logins_total',
+      help: 'Total number of login attempts',
+      labels: ['status'],
+    });
+
+    this.registerCounter({
+      name: 'savings_subscriptions_total',
+      help: 'Total savings product subscriptions',
+      labels: ['product_type', 'status'],
+    });
+
+    this.registerCounter({
+      name: 'transactions_total',
+      help: 'Total number of transactions processed',
+      labels: ['type', 'status'],
+    });
+
+    this.registerHistogram({
+      name: 'transaction_amount_usdc',
+      help: 'Transaction amounts in USDC',
+      labels: ['type'],
+      buckets: [1, 10, 50, 100, 500, 1000, 5000, 10000, 50000],
+    });
+
+    // Error metrics
+    this.registerCounter({
+      name: 'errors_total',
+      help: 'Total number of errors',
+      labels: ['type', 'route', 'status_code'],
+    });
+
+    // Database metrics
+    this.registerHistogram({
+      name: 'db_query_duration_seconds',
+      help: 'Duration of database queries in seconds',
+      labels: ['operation', 'entity'],
+      buckets: [0.001, 0.005, 0.01, 0.05, 0.1, 0.5, 1, 5],
+    });
+
+    this.registerGauge({
+      name: 'db_pool_active_connections',
+      help: 'Number of active database connections',
+      labels: [],
+    });
+
+    this.registerGauge({
+      name: 'db_pool_idle_connections',
+      help: 'Number of idle database connections',
+      labels: [],
+    });
+
+    // Auth metrics
+    this.registerCounter({
+      name: 'auth_token_refresh_total',
+      help: 'Total number of token refresh operations',
+      labels: ['status'],
+    });
+
+    this.registerCounter({
+      name: 'kyc_verifications_total',
+      help: 'Total number of KYC verification attempts',
+      labels: ['status'],
+    });
+  }
+
+  registerCounter(metric: CounterMetric): void {
+    this.metrics.set(metric.name, {
+      type: 'counter',
+      name: metric.name,
+      help: metric.help,
+      labels: metric.labels,
+      values: new Map(),
+    });
+  }
+
+  registerHistogram(metric: HistogramMetric): void {
+    this.metrics.set(metric.name, {
+      type: 'histogram',
+      name: metric.name,
+      help: metric.help,
+      labels: metric.labels,
+      values: new Map(),
+      buckets: metric.buckets,
+    });
+  }
+
+  registerGauge(metric: GaugeMetric): void {
+    this.metrics.set(metric.name, {
+      type: 'gauge',
+      name: metric.name,
+      help: metric.help,
+      labels: metric.labels,
+      values: new Map(),
+    });
+  }
+
+  incrementCounter(name: string, labels: MetricLabels = {}, value = 1): void {
+    const metric = this.metrics.get(name);
+    if (!metric || metric.type !== 'counter') return;
+
+    const key = this.buildKey(labels);
+    const current = (metric.values.get(key) as number) || 0;
+    metric.values.set(key, current + value);
+  }
+
+  recordHistogram(name: string, value: number, labels: MetricLabels = {}): void {
+    const metric = this.metrics.get(name);
+    if (!metric || metric.type !== 'histogram') return;
+
+    const key = this.buildKey(labels);
+    const existing = (metric.values.get(key) as number[]) || [];
+    existing.push(value);
+    metric.values.set(key, existing);
+  }
+
+  setGauge(name: string, value: number, labels: MetricLabels = {}): void {
+    const metric = this.metrics.get(name);
+    if (!metric || metric.type !== 'gauge') return;
+
+    const key = this.buildKey(labels);
+    metric.values.set(key, value);
+  }
+
+  private buildKey(labels: MetricLabels): string {
+    return Object.entries(labels)
+      .sort(([a], [b]) => a.localeCompare(b))
+      .map(([k, v]) => `${k}="${v}"`)
+      .join(',');
+  }
+
+  getMetricsAsPrometheusText(): string {
+    const lines: string[] = [];
+
+    for (const metric of this.metrics.values()) {
+      lines.push(`# HELP ${metric.name} ${metric.help}`);
+      lines.push(`# TYPE ${metric.name} ${metric.type}`);
+
+      if (metric.type === 'counter' || metric.type === 'gauge') {
+        for (const [labels, value] of metric.values) {
+          const labelStr = labels ? `{${labels}}` : '';
+          lines.push(`${metric.name}${labelStr} ${value}`);
+        }
+      } else if (metric.type === 'histogram') {
+        for (const [labels, values] of metric.values) {
+          const nums = values as number[];
+          const labelStr = labels ? `{${labels}}` : '';
+          const buckets = metric.buckets || this.defaultBuckets;
+
+          for (const bucket of buckets) {
+            const count = nums.filter((v) => v <= bucket).length;
+            const bucketLabel = labels
+              ? `{${labels},le="${bucket}"}`
+              : `{le="${bucket}"}`;
+            lines.push(`${metric.name}_bucket${bucketLabel} ${count}`);
+          }
+
+          const infLabel = labels
+            ? `{${labels},le="+Inf"}`
+            : `{le="+Inf"}`;
+          lines.push(`${metric.name}_bucket${infLabel} ${nums.length}`);
+
+          const sum = nums.reduce((a, b) => a + b, 0);
+          lines.push(`${metric.name}_sum${labelStr} ${sum}`);
+          lines.push(`${metric.name}_count${labelStr} ${nums.length}`);
+        }
+      }
+
+      lines.push('');
+    }
+
+    return lines.join('\n');
+  }
+
+  getMetricsSummary(): Record<string, unknown> {
+    const summary: Record<string, unknown> = {};
+
+    for (const metric of this.metrics.values()) {
+      if (metric.type === 'counter' || metric.type === 'gauge') {
+        const values: Record<string, number> = {};
+        for (const [labels, value] of metric.values) {
+          values[labels || 'total'] = value as number;
+        }
+        summary[metric.name] = { type: metric.type, values };
+      } else if (metric.type === 'histogram') {
+        const values: Record<string, unknown> = {};
+        for (const [labels, nums] of metric.values) {
+          const arr = nums as number[];
+          if (arr.length === 0) continue;
+          const sorted = [...arr].sort((a, b) => a - b);
+          values[labels || 'default'] = {
+            count: arr.length,
+            sum: arr.reduce((a, b) => a + b, 0),
+            avg: arr.reduce((a, b) => a + b, 0) / arr.length,
+            p50: sorted[Math.floor(sorted.length * 0.5)],
+            p95: sorted[Math.floor(sorted.length * 0.95)],
+            p99: sorted[Math.floor(sorted.length * 0.99)],
+            min: sorted[0],
+            max: sorted[sorted.length - 1],
+          };
+        }
+        summary[metric.name] = { type: metric.type, values };
+      }
+    }
+
+    return summary;
+  }
+}
diff --git a/backend/test/auth.e2e-spec.ts b/backend/test/auth.e2e-spec.ts
new file mode 100644
index 000000000..fddf83af0
--- /dev/null
+++ b/backend/test/auth.e2e-spec.ts
@@ -0,0 +1,245 @@
+import { INestApplication } from '@nestjs/common';
+import * as request from 'supertest';
+import {
+  createTestApp,
+  closeTestApp,
+} from './fixtures/database.helpers';
+import {
+  buildRegisterPayload,
+  buildLoginPayload,
+  uniqueEmail,
+  INVALID_PAYLOADS,
+  HTTP_STATUS,
+} from './fixtures/test-factories';
+
+describe('Auth Endpoints (e2e)', () => {
+  let app: INestApplication;
+  let accessToken: string;
+  let refreshToken: string;
+  const registeredUser = buildRegisterPayload();
+
+  beforeAll(async () => {
+    app = await createTestApp();
+  });
+
+  afterAll(async () => {
+    await closeTestApp(app);
+  });
+
+  // ── Registration ──────────────────────────────────────────────────────────
+
+  describe('POST /api/v2/auth/register', () => {
+    it('registers a new user successfully', async () => {
+      const res = await request(app.getHttpServer())
+        .post('/api/v2/auth/register')
+        .send(registeredUser)
+        .expect(HTTP_STATUS.CREATED);
+
+      expect(res.body).toHaveProperty('accessToken');
+      expect(res.body).toHaveProperty('user');
+      expect(res.body.user.email).toBe(registeredUser.email);
+      expect(res.body.user).not.toHaveProperty('password');
+    });
+
+    it('returns 409 when email already registered', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/auth/register')
+        .send(registeredUser)
+        .expect(HTTP_STATUS.CONFLICT);
+    });
+
+    it('returns 400 for missing email', async () => {
+      const res = await request(app.getHttpServer())
+        .post('/api/v2/auth/register')
+        .send(INVALID_PAYLOADS.missingEmail)
+        .expect(HTTP_STATUS.BAD_REQUEST);
+
+      expect(res.body.success).toBe(false);
+    });
+
+    it('returns 400 for invalid email format', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/auth/register')
+        .send(INVALID_PAYLOADS.invalidEmail)
+        .expect(HTTP_STATUS.BAD_REQUEST);
+    });
+
+    it('returns 400 for weak password', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/auth/register')
+        .send(INVALID_PAYLOADS.weakPassword)
+        .expect(HTTP_STATUS.BAD_REQUEST);
+    });
+
+    it('returns 400 for empty body', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/auth/register')
+        .send(INVALID_PAYLOADS.emptyBody)
+        .expect(HTTP_STATUS.BAD_REQUEST);
+    });
+
+    it('returns 400 for SQL injection attempt in email', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/auth/register')
+        .send(INVALID_PAYLOADS.sqlInjection)
+        .expect(HTTP_STATUS.BAD_REQUEST);
+    });
+
+    it('registers with referral code', async () => {
+      const payload = buildRegisterPayload({ referralCode: 'TESTCODE' });
+      const res = await request(app.getHttpServer())
+        .post('/api/v2/auth/register')
+        .send(payload);
+
+      // Either succeeds or returns invalid referral code error
+      expect([HTTP_STATUS.CREATED, HTTP_STATUS.BAD_REQUEST, HTTP_STATUS.NOT_FOUND]).toContain(
+        res.status,
+      );
+    });
+  });
+
+  // ── Login ─────────────────────────────────────────────────────────────────
+
+  describe('POST /api/v2/auth/login', () => {
+    it('logs in with valid credentials', async () => {
+      const res = await request(app.getHttpServer())
+        .post('/api/v2/auth/login')
+        .send(buildLoginPayload(registeredUser.email, registeredUser.password))
+        .expect(HTTP_STATUS.OK);
+
+      expect(res.body).toHaveProperty('accessToken');
+      accessToken = res.body.accessToken;
+      refreshToken = res.body.refreshToken;
+    });
+
+    it('returns 401 for wrong password', async () => {
+      const res = await request(app.getHttpServer())
+        .post('/api/v2/auth/login')
+        .send(buildLoginPayload(registeredUser.email, 'WrongPass!99'))
+        .expect(HTTP_STATUS.UNAUTHORIZED);
+
+      expect(res.body.success).toBe(false);
+    });
+
+    it('returns 401 for non-existent email', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/auth/login')
+        .send(buildLoginPayload('nobody@nowhere.test', 'E2eTest@123!'))
+        .expect(HTTP_STATUS.UNAUTHORIZED);
+    });
+
+    it('returns 400 for missing password', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/auth/login')
+        .send({ email: registeredUser.email })
+        .expect(HTTP_STATUS.BAD_REQUEST);
+    });
+
+    it('returns 400 for invalid email format', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/auth/login')
+        .send({ email: 'bad-email', password: 'E2eTest@123!' })
+        .expect(HTTP_STATUS.BAD_REQUEST);
+    });
+  });
+
+  // ── Token Refresh ─────────────────────────────────────────────────────────
+
+  describe('POST /api/v2/auth/refresh', () => {
+    it('returns new access token with valid refresh token', async () => {
+      if (!refreshToken) {
+        console.warn('No refresh token available, skipping refresh test');
+        return;
+      }
+
+      const res = await request(app.getHttpServer())
+        .post('/api/v2/auth/refresh')
+        .send({ refreshToken })
+        .expect(HTTP_STATUS.OK);
+
+      expect(res.body).toHaveProperty('accessToken');
+    });
+
+    it('returns 401 for invalid refresh token', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/auth/refresh')
+        .send({ refreshToken: 'invalid.token.here' })
+        .expect(HTTP_STATUS.UNAUTHORIZED);
+    });
+
+    it('returns 400 for missing refresh token', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/auth/refresh')
+        .send({})
+        .expect(HTTP_STATUS.BAD_REQUEST);
+    });
+  });
+
+  // ── Profile (JWT protected) ───────────────────────────────────────────────
+
+  describe('GET /api/v2/auth/profile', () => {
+    it('returns profile for authenticated user', async () => {
+      if (!accessToken) return;
+
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/auth/profile')
+        .set('Authorization', `Bearer ${accessToken}`)
+        .expect(HTTP_STATUS.OK);
+
+      expect(res.body).toHaveProperty('email', registeredUser.email);
+    });
+
+    it('returns 401 without token', async () => {
+      await request(app.getHttpServer())
+        .get('/api/v2/auth/profile')
+        .expect(HTTP_STATUS.UNAUTHORIZED);
+    });
+
+    it('returns 401 with malformed token', async () => {
+      await request(app.getHttpServer())
+        .get('/api/v2/auth/profile')
+        .set('Authorization', 'Bearer not.a.real.token')
+        .expect(HTTP_STATUS.UNAUTHORIZED);
+    });
+  });
+
+  // ── Logout ────────────────────────────────────────────────────────────────
+
+  describe('POST /api/v2/auth/logout', () => {
+    it('logs out authenticated user', async () => {
+      if (!accessToken) return;
+
+      const res = await request(app.getHttpServer())
+        .post('/api/v2/auth/logout')
+        .set('Authorization', `Bearer ${accessToken}`);
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.NO_CONTENT]).toContain(res.status);
+    });
+
+    it('returns 401 without token', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/auth/logout')
+        .expect(HTTP_STATUS.UNAUTHORIZED);
+    });
+  });
+
+  // ── Wallet Nonce ─────────────────────────────────────────────────────────
+
+  describe('GET /api/v2/auth/nonce', () => {
+    it('returns nonce for valid Stellar public key', async () => {
+      const validKey = 'GABC' + 'A'.repeat(52);
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/auth/nonce')
+        .query({ publicKey: validKey });
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.BAD_REQUEST]).toContain(res.status);
+    });
+
+    it('returns 400 for invalid Stellar key', async () => {
+      await request(app.getHttpServer())
+        .get('/api/v2/auth/nonce')
+        .query({ publicKey: 'not-a-stellar-key' })
+        .expect(HTTP_STATUS.BAD_REQUEST);
+    });
+  });
+});
diff --git a/backend/test/fixtures/database.helpers.ts b/backend/test/fixtures/database.helpers.ts
new file mode 100644
index 000000000..f27c09e06
--- /dev/null
+++ b/backend/test/fixtures/database.helpers.ts
@@ -0,0 +1,45 @@
+import { INestApplication } from '@nestjs/common';
+import { DataSource } from 'typeorm';
+import { Test, TestingModule } from '@nestjs/testing';
+import { AppModule } from '../../src/app.module';
+import { ValidationPipe } from '@nestjs/common';
+
+export async function createTestApp(): Promise<INestApplication> {
+  const moduleFixture: TestingModule = await Test.createTestingModule({
+    imports: [AppModule],
+  }).compile();
+
+  const app = moduleFixture.createNestApplication();
+  app.setGlobalPrefix('api');
+  app.useGlobalPipes(
+    new ValidationPipe({
+      whitelist: true,
+      forbidNonWhitelisted: true,
+      transform: true,
+    }),
+  );
+  await app.init();
+  return app;
+}
+
+export function getDataSource(app: INestApplication): DataSource {
+  return app.get<DataSource>(DataSource);
+}
+
+export async function clearTable(dataSource: DataSource, tableName: string): Promise<void> {
+  try {
+    await dataSource.query(`TRUNCATE TABLE "${tableName}" CASCADE`);
+  } catch {
+    // Table may not exist in test; ignore
+  }
+}
+
+export async function clearTestUsers(dataSource: DataSource): Promise<void> {
+  await clearTable(dataSource, 'users');
+}
+
+export async function closeTestApp(app: INestApplication): Promise<void> {
+  if (app) {
+    await app.close();
+  }
+}
diff --git a/backend/test/fixtures/test-factories.ts b/backend/test/fixtures/test-factories.ts
new file mode 100644
index 000000000..d99c89257
--- /dev/null
+++ b/backend/test/fixtures/test-factories.ts
@@ -0,0 +1,83 @@
+import { v4 as uuidv4 } from 'uuid';
+
+export interface TestUserCredentials {
+  email: string;
+  password: string;
+  name?: string;
+}
+
+let counter = 0;
+
+export function uniqueEmail(prefix = 'test'): string {
+  counter++;
+  return `${prefix}+${Date.now()}${counter}@e2e.test`;
+}
+
+export function buildRegisterPayload(overrides: Partial<TestUserCredentials> = {}): TestUserCredentials {
+  return {
+    email: uniqueEmail(),
+    password: 'E2eTest@123!',
+    name: 'E2E Test User',
+    ...overrides,
+  };
+}
+
+export function buildLoginPayload(email: string, password = 'E2eTest@123!') {
+  return { email, password };
+}
+
+export function buildUpdateProfilePayload(overrides: Record<string, unknown> = {}) {
+  return {
+    name: 'Updated Name',
+    ...overrides,
+  };
+}
+
+export function buildPaginationQuery(page = 1, limit = 10) {
+  return { page, limit };
+}
+
+export function buildSavingsFilterQuery(overrides: Record<string, unknown> = {}) {
+  return {
+    page: 1,
+    limit: 10,
+    order: 'ASC',
+    ...overrides,
+  };
+}
+
+export function buildTransactionFilterQuery(overrides: Record<string, unknown> = {}) {
+  return {
+    page: 1,
+    limit: 10,
+    ...overrides,
+  };
+}
+
+export const INVALID_PAYLOADS = {
+  emptyBody: {},
+  missingEmail: { password: 'E2eTest@123!', name: 'Test' },
+  invalidEmail: { email: 'not-an-email', password: 'E2eTest@123!', name: 'Test' },
+  weakPassword: { email: uniqueEmail(), password: 'weak', name: 'Test' },
+  missingPassword: { email: uniqueEmail(), name: 'Test' },
+  sqlInjection: { email: "' OR 1=1 --", password: 'anything', name: 'hack' },
+  xssAttempt: {
+    email: uniqueEmail(),
+    password: 'E2eTest@123!',
+    name: '<script>alert(1)</script>',
+  },
+};
+
+export const HTTP_STATUS = {
+  OK: 200,
+  CREATED: 201,
+  NO_CONTENT: 204,
+  BAD_REQUEST: 400,
+  UNAUTHORIZED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  CONFLICT: 409,
+  UNPROCESSABLE: 422,
+  TOO_MANY_REQUESTS: 429,
+  INTERNAL_ERROR: 500,
+} as const;
diff --git a/backend/test/health.e2e-spec.ts b/backend/test/health.e2e-spec.ts
new file mode 100644
index 000000000..bcb8dbffa
--- /dev/null
+++ b/backend/test/health.e2e-spec.ts
@@ -0,0 +1,59 @@
+import { INestApplication } from '@nestjs/common';
+import * as request from 'supertest';
+import { createTestApp, closeTestApp } from './fixtures/database.helpers';
+import { HTTP_STATUS } from './fixtures/test-factories';
+
+describe('Health Endpoints (e2e)', () => {
+  let app: INestApplication;
+
+  beforeAll(async () => {
+    app = await createTestApp();
+  });
+
+  afterAll(async () => {
+    await closeTestApp(app);
+  });
+
+  describe('GET /api/health', () => {
+    it('returns health status', async () => {
+      const res = await request(app.getHttpServer()).get('/api/health');
+
+      expect([HTTP_STATUS.OK, 503]).toContain(res.status);
+      expect(res.body).toBeDefined();
+    });
+
+    it('responds with a JSON body', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/health')
+        .expect('Content-Type', /json/);
+
+      expect(res.body).toHaveProperty('status');
+    });
+  });
+
+  describe('GET /api/health/detailed', () => {
+    it('returns detailed health including db, redis, etc.', async () => {
+      const res = await request(app.getHttpServer()).get('/api/health/detailed');
+
+      expect([HTTP_STATUS.OK, 503, HTTP_STATUS.NOT_FOUND]).toContain(res.status);
+    });
+  });
+
+  describe('GET /api/v2/performance/slow-queries', () => {
+    it('returns slow queries (requires auth)', async () => {
+      const res = await request(app.getHttpServer()).get(
+        '/api/v2/performance/slow-queries',
+      );
+
+      expect([HTTP_STATUS.UNAUTHORIZED, HTTP_STATUS.OK]).toContain(res.status);
+    });
+  });
+
+  describe('GET /api/v2/apm/metrics', () => {
+    it('returns prometheus metrics without auth', async () => {
+      const res = await request(app.getHttpServer()).get('/api/v2/apm/metrics');
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.NOT_FOUND]).toContain(res.status);
+    });
+  });
+});
diff --git a/backend/test/jest-e2e-setup.ts b/backend/test/jest-e2e-setup.ts
index dc32443ac..b2ad1b031 100644
--- a/backend/test/jest-e2e-setup.ts
+++ b/backend/test/jest-e2e-setup.ts
@@ -46,3 +46,19 @@ process.env.REDIS_URL = process.env.REDIS_URL || 'redis://localhost:6379';
 process.env.STELLAR_WEBHOOK_SECRET =
   process.env.STELLAR_WEBHOOK_SECRET ||
   'test_webhook_secret_long_enough_minimum_16_chars';
+
+// Fallback URLs required by env validation
+process.env.SOROBAN_RPC_FALLBACK_URLS =
+  process.env.SOROBAN_RPC_FALLBACK_URLS ||
+  'https://soroban-testnet.stellar.org';
+process.env.HORIZON_FALLBACK_URLS =
+  process.env.HORIZON_FALLBACK_URLS || 'https://horizon-testnet.stellar.org';
+
+// APM configuration
+process.env.APM_SAMPLING_RATE = process.env.APM_SAMPLING_RATE || '1.0';
+process.env.APM_ENABLED = process.env.APM_ENABLED || 'true';
+
+// DB pool retry configuration (fast retries in tests)
+process.env.DB_MAX_RETRIES = process.env.DB_MAX_RETRIES || '3';
+process.env.DB_RETRY_INITIAL_DELAY = process.env.DB_RETRY_INITIAL_DELAY || '100';
+process.env.DB_POOL_MONITOR_INTERVAL = process.env.DB_POOL_MONITOR_INTERVAL || '60000';
diff --git a/backend/test/jest-e2e.json b/backend/test/jest-e2e.json
index 53e5b6b53..84d30fb8d 100644
--- a/backend/test/jest-e2e.json
+++ b/backend/test/jest-e2e.json
@@ -3,9 +3,31 @@
   "rootDir": ".",
   "testEnvironment": "node",
   "testRegex": ".e2e-spec.ts$",
-  "setupFilesAfterEnv": ["./jest-e2e-setup.ts"],
   "transform": {
     "^.+\\.(t|j)s$": "ts-jest"
   },
-  "setupFilesAfterEnv": ["<rootDir>/jest-e2e-setup.ts"]
+  "setupFilesAfterEnv": ["<rootDir>/jest-e2e-setup.ts"],
+  "collectCoverage": false,
+  "coverageDirectory": "../coverage/e2e",
+  "coverageReporters": ["text", "lcov", "html"],
+  "collectCoverageFrom": [
+    "../src/**/*.ts",
+    "!../src/**/*.spec.ts",
+    "!../src/**/*.module.ts",
+    "!../src/main.ts",
+    "!../src/migrations/**",
+    "!../src/**/*.entity.ts"
+  ],
+  "coverageThreshold": {
+    "global": {
+      "branches": 60,
+      "functions": 70,
+      "lines": 75,
+      "statements": 75
+    }
+  },
+  "testTimeout": 30000,
+  "moduleNameMapper": {
+    "^@/(.*)$": "<rootDir>/../src/$1"
+  }
 }
diff --git a/backend/test/savings.e2e-spec.ts b/backend/test/savings.e2e-spec.ts
new file mode 100644
index 000000000..be91908ac
--- /dev/null
+++ b/backend/test/savings.e2e-spec.ts
@@ -0,0 +1,160 @@
+import { INestApplication } from '@nestjs/common';
+import * as request from 'supertest';
+import { createTestApp, closeTestApp } from './fixtures/database.helpers';
+import {
+  buildRegisterPayload,
+  buildPaginationQuery,
+  HTTP_STATUS,
+} from './fixtures/test-factories';
+
+describe('Savings Endpoints (e2e)', () => {
+  let app: INestApplication;
+  let accessToken: string;
+
+  const user = buildRegisterPayload();
+
+  beforeAll(async () => {
+    app = await createTestApp();
+
+    const res = await request(app.getHttpServer())
+      .post('/api/v2/auth/register')
+      .send(user);
+
+    accessToken = res.body.accessToken;
+  });
+
+  afterAll(async () => {
+    await closeTestApp(app);
+  });
+
+  function authHeader() {
+    return { Authorization: `Bearer ${accessToken}` };
+  }
+
+  // ── Products ──────────────────────────────────────────────────────────────
+
+  describe('GET /api/v2/savings/products', () => {
+    it('returns list of savings products', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/savings/products')
+        .set(authHeader());
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.UNAUTHORIZED]).toContain(res.status);
+      if (res.status === HTTP_STATUS.OK) {
+        expect(Array.isArray(res.body) || Array.isArray(res.body.data)).toBe(true);
+      }
+    });
+
+    it('supports pagination', async () => {
+      const query = buildPaginationQuery(1, 5);
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/savings/products')
+        .query(query)
+        .set(authHeader());
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.UNAUTHORIZED]).toContain(res.status);
+    });
+
+    it('returns 400 for invalid page param', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/savings/products')
+        .query({ page: -1 })
+        .set(authHeader());
+
+      expect([HTTP_STATUS.BAD_REQUEST, HTTP_STATUS.OK]).toContain(res.status);
+    });
+
+    it('returns 401 without auth', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/savings/products');
+
+      expect([HTTP_STATUS.UNAUTHORIZED, HTTP_STATUS.OK]).toContain(res.status);
+    });
+  });
+
+  // ── Subscriptions ─────────────────────────────────────────────────────────
+
+  describe('GET /api/v2/savings/subscriptions', () => {
+    it('returns user subscriptions', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/savings/subscriptions')
+        .set(authHeader());
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.UNAUTHORIZED]).toContain(res.status);
+    });
+
+    it('returns 401 without auth', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/savings/subscriptions');
+
+      expect([HTTP_STATUS.UNAUTHORIZED, HTTP_STATUS.OK]).toContain(res.status);
+    });
+  });
+
+  // ── Goals ────────────────────────────────────────────────────────────────
+
+  describe('GET /api/v2/savings/goals', () => {
+    it('returns savings goals for user', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/savings/goals')
+        .set(authHeader());
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.NOT_FOUND, HTTP_STATUS.UNAUTHORIZED]).toContain(
+        res.status,
+      );
+    });
+  });
+
+  describe('POST /api/v2/savings/goals', () => {
+    it('returns 400 for invalid goal payload', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/savings/goals')
+        .set(authHeader())
+        .send({})
+        .expect((res) => {
+          expect([HTTP_STATUS.BAD_REQUEST, HTTP_STATUS.UNPROCESSABLE]).toContain(res.status);
+        });
+    });
+
+    it('returns 401 without auth', async () => {
+      await request(app.getHttpServer())
+        .post('/api/v2/savings/goals')
+        .send({ name: 'Test Goal', targetAmount: 1000 })
+        .expect((res) => {
+          expect([HTTP_STATUS.UNAUTHORIZED, HTTP_STATUS.CREATED]).toContain(res.status);
+        });
+    });
+  });
+
+  // ── Compare Products ──────────────────────────────────────────────────────
+
+  describe('GET /api/v2/savings/products/compare', () => {
+    it('returns comparison data when valid IDs given', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/savings/products/compare')
+        .query({ ids: 'fake-id-1,fake-id-2' })
+        .set(authHeader());
+
+      expect([
+        HTTP_STATUS.OK,
+        HTTP_STATUS.BAD_REQUEST,
+        HTTP_STATUS.NOT_FOUND,
+        HTTP_STATUS.UNAUTHORIZED,
+      ]).toContain(res.status);
+    });
+  });
+
+  // ── Waitlist ─────────────────────────────────────────────────────────────
+
+  describe('GET /api/v2/savings/waitlist', () => {
+    it('returns waitlist status', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/savings/waitlist')
+        .set(authHeader());
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.NOT_FOUND, HTTP_STATUS.UNAUTHORIZED]).toContain(
+        res.status,
+      );
+    });
+  });
+});
diff --git a/backend/test/transactions.e2e-spec.ts b/backend/test/transactions.e2e-spec.ts
new file mode 100644
index 000000000..cf6420f37
--- /dev/null
+++ b/backend/test/transactions.e2e-spec.ts
@@ -0,0 +1,167 @@
+import { INestApplication } from '@nestjs/common';
+import * as request from 'supertest';
+import { createTestApp, closeTestApp } from './fixtures/database.helpers';
+import {
+  buildRegisterPayload,
+  buildTransactionFilterQuery,
+  HTTP_STATUS,
+} from './fixtures/test-factories';
+
+describe('Transactions Endpoints (e2e)', () => {
+  let app: INestApplication;
+  let accessToken: string;
+
+  const user = buildRegisterPayload();
+
+  beforeAll(async () => {
+    app = await createTestApp();
+
+    const res = await request(app.getHttpServer())
+      .post('/api/v2/auth/register')
+      .send(user);
+
+    accessToken = res.body.accessToken;
+  });
+
+  afterAll(async () => {
+    await closeTestApp(app);
+  });
+
+  function authHeader() {
+    return { Authorization: `Bearer ${accessToken}` };
+  }
+
+  // ── List Transactions ─────────────────────────────────────────────────────
+
+  describe('GET /api/v2/transactions', () => {
+    it('returns paginated transaction list', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/transactions')
+        .set(authHeader())
+        .query(buildTransactionFilterQuery());
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.UNAUTHORIZED]).toContain(res.status);
+      if (res.status === HTTP_STATUS.OK) {
+        const body = res.body;
+        expect(body).toBeDefined();
+      }
+    });
+
+    it('returns 401 without auth', async () => {
+      await request(app.getHttpServer())
+        .get('/api/v2/transactions')
+        .expect((res) => {
+          expect([HTTP_STATUS.UNAUTHORIZED, HTTP_STATUS.OK]).toContain(res.status);
+        });
+    });
+
+    it('filters by type', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/transactions')
+        .set(authHeader())
+        .query({ type: 'deposit', page: 1, limit: 5 });
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.BAD_REQUEST, HTTP_STATUS.UNAUTHORIZED]).toContain(
+        res.status,
+      );
+    });
+
+    it('filters by date range', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/transactions')
+        .set(authHeader())
+        .query({
+          startDate: '2024-01-01',
+          endDate: '2024-12-31',
+          page: 1,
+          limit: 10,
+        });
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.BAD_REQUEST, HTTP_STATUS.UNAUTHORIZED]).toContain(
+        res.status,
+      );
+    });
+
+    it('returns 400 for invalid limit', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/transactions')
+        .set(authHeader())
+        .query({ limit: 999999 });
+
+      expect([HTTP_STATUS.BAD_REQUEST, HTTP_STATUS.OK]).toContain(res.status);
+    });
+  });
+
+  // ── Single Transaction ────────────────────────────────────────────────────
+
+  describe('GET /api/v2/transactions/:id', () => {
+    it('returns 404 for non-existent transaction', async () => {
+      const fakeId = '00000000-0000-4000-8000-000000000001';
+      const res = await request(app.getHttpServer())
+        .get(`/api/v2/transactions/${fakeId}`)
+        .set(authHeader());
+
+      expect([HTTP_STATUS.NOT_FOUND, HTTP_STATUS.UNAUTHORIZED]).toContain(res.status);
+    });
+
+    it('returns 401 without auth', async () => {
+      const fakeId = '00000000-0000-4000-8000-000000000001';
+      await request(app.getHttpServer())
+        .get(`/api/v2/transactions/${fakeId}`)
+        .expect((res) => {
+          expect([HTTP_STATUS.UNAUTHORIZED, HTTP_STATUS.NOT_FOUND]).toContain(res.status);
+        });
+    });
+
+    it('returns 400 for malformed UUID', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/transactions/not-a-uuid')
+        .set(authHeader());
+
+      expect([HTTP_STATUS.BAD_REQUEST, HTTP_STATUS.NOT_FOUND]).toContain(res.status);
+    });
+  });
+
+  // ── Transaction Tags ──────────────────────────────────────────────────────
+
+  describe('GET /api/v2/transactions/tags', () => {
+    it('returns available tags', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/transactions/tags')
+        .set(authHeader());
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.NOT_FOUND, HTTP_STATUS.UNAUTHORIZED]).toContain(
+        res.status,
+      );
+    });
+  });
+
+  // ── Error Scenarios ───────────────────────────────────────────────────────
+
+  describe('Error scenarios', () => {
+    it('pagination out-of-range returns empty or error', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/transactions')
+        .set(authHeader())
+        .query({ page: 99999, limit: 10 });
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.BAD_REQUEST]).toContain(res.status);
+      if (res.status === HTTP_STATUS.OK) {
+        const body = res.body;
+        const data = body.data || body;
+        expect(Array.isArray(data) ? data.length : 0).toBeLessThanOrEqual(10);
+      }
+    });
+
+    it('responds consistently without leaking internal details', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/transactions/malformed')
+        .set(authHeader());
+
+      if (res.status >= 400) {
+        expect(res.body).not.toHaveProperty('stack');
+        expect(res.body).not.toHaveProperty('query');
+      }
+    });
+  });
+});
diff --git a/backend/test/users.e2e-spec.ts b/backend/test/users.e2e-spec.ts
new file mode 100644
index 000000000..63b82052f
--- /dev/null
+++ b/backend/test/users.e2e-spec.ts
@@ -0,0 +1,177 @@
+import { INestApplication } from '@nestjs/common';
+import * as request from 'supertest';
+import {
+  createTestApp,
+  closeTestApp,
+} from './fixtures/database.helpers';
+import {
+  buildRegisterPayload,
+  buildLoginPayload,
+  buildUpdateProfilePayload,
+  HTTP_STATUS,
+} from './fixtures/test-factories';
+
+describe('User Endpoints (e2e)', () => {
+  let app: INestApplication;
+  let accessToken: string;
+  let userId: string;
+
+  const user = buildRegisterPayload();
+
+  beforeAll(async () => {
+    app = await createTestApp();
+
+    const regRes = await request(app.getHttpServer())
+      .post('/api/v2/auth/register')
+      .send(user);
+
+    if (regRes.status === HTTP_STATUS.CREATED) {
+      accessToken = regRes.body.accessToken;
+      userId = regRes.body.user?.id;
+    } else {
+      const loginRes = await request(app.getHttpServer())
+        .post('/api/v2/auth/login')
+        .send(buildLoginPayload(user.email, user.password));
+      accessToken = loginRes.body.accessToken;
+      userId = loginRes.body.user?.id;
+    }
+  });
+
+  afterAll(async () => {
+    await closeTestApp(app);
+  });
+
+  function authHeader() {
+    return { Authorization: `Bearer ${accessToken}` };
+  }
+
+  // ── Profile ───────────────────────────────────────────────────────────────
+
+  describe('GET /api/v2/users/profile', () => {
+    it('returns current user profile', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/users/profile')
+        .set(authHeader())
+        .expect(HTTP_STATUS.OK);
+
+      expect(res.body).toHaveProperty('email', user.email);
+      expect(res.body).not.toHaveProperty('password');
+    });
+
+    it('returns 401 without auth token', async () => {
+      await request(app.getHttpServer())
+        .get('/api/v2/users/profile')
+        .expect(HTTP_STATUS.UNAUTHORIZED);
+    });
+  });
+
+  // ── Update Profile ────────────────────────────────────────────────────────
+
+  describe('PATCH /api/v2/users/profile', () => {
+    it('updates user name', async () => {
+      const payload = buildUpdateProfilePayload({ name: 'New Name' });
+      const res = await request(app.getHttpServer())
+        .patch('/api/v2/users/profile')
+        .set(authHeader())
+        .send(payload);
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.NO_CONTENT]).toContain(res.status);
+    });
+
+    it('returns 401 without auth', async () => {
+      await request(app.getHttpServer())
+        .patch('/api/v2/users/profile')
+        .send(buildUpdateProfilePayload())
+        .expect(HTTP_STATUS.UNAUTHORIZED);
+    });
+
+    it('ignores unknown fields (whitelist)', async () => {
+      const res = await request(app.getHttpServer())
+        .patch('/api/v2/users/profile')
+        .set(authHeader())
+        .send({ name: 'Valid', unknownField: 'injected' });
+
+      expect([
+        HTTP_STATUS.OK,
+        HTTP_STATUS.NO_CONTENT,
+        HTTP_STATUS.BAD_REQUEST,
+      ]).toContain(res.status);
+    });
+  });
+
+  // ── Net Worth ─────────────────────────────────────────────────────────────
+
+  describe('GET /api/v2/users/net-worth', () => {
+    it('returns net worth for authenticated user', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/users/net-worth')
+        .set(authHeader());
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.NOT_FOUND]).toContain(res.status);
+    });
+
+    it('returns 401 without auth', async () => {
+      await request(app.getHttpServer())
+        .get('/api/v2/users/net-worth')
+        .expect(HTTP_STATUS.UNAUTHORIZED);
+    });
+  });
+
+  // ── Wallet ────────────────────────────────────────────────────────────────
+
+  describe('GET /api/v2/users/wallet', () => {
+    it('returns wallet info', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/users/wallet')
+        .set(authHeader());
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.NOT_FOUND]).toContain(res.status);
+    });
+
+    it('returns 401 without auth', async () => {
+      await request(app.getHttpServer())
+        .get('/api/v2/users/wallet')
+        .expect(HTTP_STATUS.UNAUTHORIZED);
+    });
+  });
+
+  // ── Sweep Settings ────────────────────────────────────────────────────────
+
+  describe('GET /api/v2/users/sweep-settings', () => {
+    it('returns sweep settings', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/users/sweep-settings')
+        .set(authHeader());
+
+      expect([HTTP_STATUS.OK, HTTP_STATUS.NOT_FOUND]).toContain(res.status);
+    });
+
+    it('returns 401 without auth', async () => {
+      await request(app.getHttpServer())
+        .get('/api/v2/users/sweep-settings')
+        .expect(HTTP_STATUS.UNAUTHORIZED);
+    });
+  });
+
+  // ── Response Shape ────────────────────────────────────────────────────────
+
+  describe('Response shape validation', () => {
+    it('profile response never exposes password hash', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/users/profile')
+        .set(authHeader())
+        .expect(HTTP_STATUS.OK);
+
+      expect(res.body.password).toBeUndefined();
+      expect(res.body.passwordHash).toBeUndefined();
+    });
+
+    it('error responses include success:false', async () => {
+      const res = await request(app.getHttpServer())
+        .get('/api/v2/users/profile');
+
+      expect(res.status).toBe(HTTP_STATUS.UNAUTHORIZED);
+      expect(res.body.success).toBe(false);
+    });
+  });
+});