feat(sdp-web): add csv export to dashboard

[enochakinbode]

Summary

Adds CSV export support for the dashboard Payments transactions view. Issue: #716

This PR is expected to include both sides of the feature: a dashboard action that lets users download the currently filtered transaction list, and a dashboard API route that generates the CSV from SDP API transfer data. The export preserves the same filters used by the transactions table, fetches paginated results server-side, and returns a downloadable CSV file for reconciliation and audit workflows.

Changes

• Add a transactions CSV download action to the dashboard
• Add /api/dashboard/payments/transactions/export as the dashboard-owned CSV export route
• Preserve transaction filters when exporting
• Generate CSV with stable transaction columns
• Escape CSV values containing commas, quotes, or newlines
• Fetch additional pages using meta.total and meta.hasMore
• Add unit coverage for filtering, pagination, CSV escaping, and upstream API errors

Testing

pnpm --filter sdp-web test:unit -- src/app/api/dashboard/payments/transactions/export/route.unit.test.ts

[vercel]

@enochakinbode is attempting to deploy a commit to the Solana Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

Greptile Summary

Adds filtered transaction CSV exports to the payments dashboard.

• Adds a project-scoped API route that paginates transfer results and serializes stable CSV columns.
• Adds download actions and localized status/error copy to transaction and counterparty views.
• Adds shared browser download handling and route-level unit coverage.

Confidence Score: 4/5

The PR should not merge until CSV formula neutralization also handles non-ASCII whitespace and invisible formatting characters.

Free-form transfer fields reach the CSV serializer, but its first-content-character scan skips only ASCII controls and space; an invisible Unicode prefix can therefore leave a following spreadsheet formula marker active.

Files Needing Attention: apps/sdp-web/src/app/api/dashboard/payments/transactions/export/route.ts

Important Files Changed

Filename	Overview
apps/sdp-web/src/app/api/dashboard/payments/transactions/export/route.ts	Adds the paginated transfer-export route and CSV serializer.
apps/sdp-web/src/app/api/dashboard/payments/transactions/export/route.unit.test.ts	Covers filtering, pagination, ordinary CSV escaping, formula prefixes, and upstream errors.
apps/sdp-web/src/app/dashboard/payments/transactions/transactions-workspace.tsx	Adds a filtered CSV download action and visible loading/error state.
apps/sdp-web/src/app/dashboard/payments/counterparty/counterparty-detail-workspace.tsx	Adds counterparty-scoped CSV export using the active type and provider filters.
apps/sdp-web/src/lib/download.ts	Adds browser blob-download handling with response-derived filenames.

Sequence Diagram

sequenceDiagram
  participant U as Dashboard user
  participant W as Payments workspace
  participant E as CSV export route
  participant A as SDP API
  U->>W: Download filtered transactions
  W->>E: GET export with active filters
  loop Transfer pages
    E->>A: GET /v1/payments/transfers
    A-->>E: Transfer data and pagination metadata
  end
  E-->>W: CSV attachment
  W-->>U: Browser download

Loading

_{Reviews (8): Last reviewed commit: "feat: add dashboard transactions CSV exp..." | Re-trigger Greptile}

[GuiBibeau]

@enochakinbode thanks for this! can you fix CI/CD?

[enochakinbode]

@GuiBibeau done.

[resourcefulmind]

@enochakinbode apologies for the runaround on CI. As a first-time contributor from a fork, GitHub holds every workflow run until a maintainer approves it, so nothing had actually executed. I've approved the runs and CI is going now. Pushing more commits was never going to change it, so that's on us, not you.

Three things left, and only two of them are yours:

1. Sign your commits. This is the real merge blocker.
2. Merge main into your branch. It's behind. Please do this on your side rather than using the "Update branch" button here: if I press it, I become the last pusher and branch protection then blocks me from being the approving reviewer.
3. Ignore the two Vercel checks. "Authorization required to deploy" needs a Foundation team member to authorize a fork deploy in the Vercel dashboard. Nothing you can do, and they're not required checks, so they don't block the merge.

I'd like you to also consider this optional fix to toughen things up:

1. The formula-injection guard in route.ts:84-98 skips characters <= 0x20 before testing the prefix, so invisible Unicode slips through and a memo like ​=cmd still reaches Excel as a formula. Extending the skip set to cover zero-width and non-breaking spaces would close it. Happy to merge without it if you'd rather keep the diff tight.

Once it's green I'll review. @multipletwigs you're the assignee on #716 and you already agreed the CSV-only scope, so a second pair of eyes from you would be ideal.