Fix fetchDaysTraded to use reports API with bearer auth and correct daysTraded counting

- Replace fill/ldeps and fill/list approaches with Tradovate reports API
- Add bearer auth to getreport polling (root cause of prior 404s)
- Use endDate = tomorrow to ensure current-session fills are included
- Count all traded days when minDayPnL is 0, otherwise count days >= minDayPnL
- Add PATCH /api/debug endpoint for proxying raw Tradovate API calls

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/debug/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server';
 import { getClients, resetClients } from '@/lib/clients';
 import { getFirms } from '@/lib/db';
+import axios from 'axios';
 
 export async function GET() {
     try {
@@ -83,6 +84,96 @@ export async function POST() {
     }
 }
 
+/**
+ * PATCH /api/debug — probe Tradovate APIs using a firm's access token.
+ *
+ * Generic proxy:  { firmId, path?, url?, method?, body? }
+ * Full report run: { firmId, action: 'report', account, startDate, endDate }
+ *   → does requestreport + getreport polling in one server-side call, returns raw data string
+ */
+export async function PATCH(req: Request) {
+    try {
+        const payload = await req.json();
+        const { firmId } = payload;
+        const client = getClients().get(firmId) as any;
+        if (!client?.accessInfo?.accessToken) {
+            return NextResponse.json({ error: 'no token for firmId ' + firmId }, { status: 400 });
+        }
+        const headers = { Authorization: `Bearer ${client.accessInfo.accessToken}` };
+
+        // Full report cycle
+        if (payload.action === 'report') {
+            const { account, startDate, endDate } = payload;
+            try {
+                let reportData = (await axios.post(
+                    'https://rpt-demo.tradovateapi.com/v1/reports/requestreport',
+                    {
+                        name: 'Fills', representationType: 'json', timezone: -300,
+                        params: [
+                            { name: 'startDate', value: startDate },
+                            { name: 'endDate',   value: endDate },
+                            { name: 'startTime', value: '00:00:00' },
+                            { name: 'endTime',   value: '00:00:00' },
+                            ...(account ? [{ name: 'account', value: account }] : []),
+                        ],
+                    },
+                    { headers }
+                )).data;
+
+                let attempts = 0;
+                while (reportData?.['p-ticket'] && attempts < 30) {
+                    const ticket: string = reportData['p-ticket'];
+                    const wait: number = Math.max(1, reportData['p-time'] ?? 1);
+                    await new Promise((r) => setTimeout(r, wait * 1000));
+                    reportData = (await axios.get(
+                        'https://rpt-demo.tradovateapi.com/v1/reports/getreport',
+                        { params: { 'p-ticket': ticket }, headers }
+                    )).data;
+                    attempts++;
+                }
+
+                const raw: string = typeof reportData?.data === 'string' ? reportData.data : JSON.stringify(reportData);
+                // Parse to count fills and unique tradeDates
+                let fillCount = 0;
+                let uniqueDates: string[] = [];
+                try {
+                    const fixed = raw.replace(/"_tradeDate":\s*(\d{4}-\d{2}-\d{2})/g, '"_tradeDate": "$1"');
+                    const parsed: any[] = JSON.parse(fixed);
+                    fillCount = parsed.length;
+                    uniqueDates = [...new Set(parsed.map((f) => f._tradeDate as string))].sort();
+                } catch { /* not parseable yet */ }
+                return NextResponse.json({ ok: true, attempts, rawLen: raw.length, fillCount, uniqueDates, preview: raw.slice(0, 400) });
+            } catch (err: any) {
+                return NextResponse.json({
+                    ok: false,
+                    status: err?.response?.status,
+                    data: err?.response?.data,
+                    message: err?.message,
+                });
+            }
+        }
+
+        // Generic proxy
+        const { path, url: rawUrl, method = 'GET', body: reqBody } = payload;
+        const url = rawUrl ?? `https://demo.tradovateapi.com/v1/${path}`;
+        try {
+            const res = method === 'POST'
+                ? await axios.post(url, reqBody, { headers })
+                : await axios.get(url, { headers });
+            return NextResponse.json({ ok: true, status: res.status, data: res.data });
+        } catch (err: any) {
+            return NextResponse.json({
+                ok: false,
+                status: err?.response?.status,
+                data: err?.response?.data,
+                message: err?.message,
+            });
+        }
+    } catch (err) {
+        return NextResponse.json({ error: String(err) }, { status: 500 });
+    }
+}
+
 /**
  * DELETE /api/debug — force-reinitialize all Tradovate clients with fresh instances
  * Clears the global pool so getClients() recreates everything from DB on next call.