Even an AJAX endpoint should be tested! Not at the controller level because the controller is the consumer, the JSON/XML output is your HTML template (just a converted structure) so if the contents are correct then it's reasonable to expect the JSON/XML is correct if you're using a standardized way of rendering it. And you could test your client-side JS to ensure it works too, starting with the "most degenerate" cases such as a 500 or 404.

> Forcing myself to refactor rather than "making progress" is going to be a mindshift.

Indeed. It's like being an ex-heroin addict or something... but when you get to a point where a project is mature, you appreciate your prior restraint every single day. Think about it more like a tank rolling forward, powerful and hard to stop. Not so much like a bullet train that might derail at the next bend.

I have the tightest testing requirements on the most internal components; business logic at the center. Leaf nodes have the least testing applied, so for example:
- (Web/HTML) Templates are dumb, they get hit @ manual, browser-based V&V but nowhere else; nothing is leafier than this
- Controllers basically just inject values into templates, my controllers are so simple that I actually only test the number of variables I am binding. This sounds so lazy it doesn't seem like it could provide anything but this has worked shockingly well for me (yes, even alerted me to oversights) because there is absolutely minimal logic in the controller, often boiling down to decisions about what to bind based upon a result. This is the node connecting the leaf and the branch, it's a tiny little thing. I usually test their display method and make sure they inject the correct number of variables. If I can do that and my factory (which is effectively the integration test for this unit) can create the object then I consider the controller working. If there's anything else which could fail, it doesn't belong in the controller.

At the other end of the spectrum are things at the core of your system which are obviously wanting of stringent testing like:
- Business logic
- Billing

This is a balance you have to strike but be consistent with whatever you choose.

Regarding CRUD and also applicable to APIs, separate your use of those things from the logic which operates on their results. So if you're writing something which uses the filesystem for CRUD you want to get ONLY the CRUD isolated in one layer. If you look at that CRUD class you won't be able to determine anything about the larger system or its purpose; the CRUD class will only deal with file creation/reading/update/delete and nothing else. It doesn't consider, manipulate, iterate, process or do anything with the contents. If you truly isolate that level then you can test your ENTIRE system (each action in isolation) and ensure the CRUD calls are made as expected, without touching disk.

As soon as you isolate the statefulness of the filesystem or database or remote service, testing is easy because (assuming you inject dependencies so they aren't hardwired) you can replace the CRUD service with a mock which will affirmatively pass or fail with a specified result at your command. If you can "play God" with return values like that then you can test the logic of that unit without restriction, hindrance or interference. What happens to this component if the CRUD class can't open the file? Just write a new test for it and mock CRUD's state to the same it is when it can't find the file. Assert what you want to happen. If it doesn't work as expected (the test fails) then you can fix the problem and prove that you didn't break anything else while resolving that issue by running against all of the previously-passing tests. If the test passed, you can keep the test and ensure the behavior remains unchanged through future edits.

APIs are difficult because they can change and their natures can be very different. Integrating with a local or regional company doesn't often resemble the experience of integrating with a giant like Google for example.

I would not test Google's API, period. When dealing with smaller companies however, it's a sticky kind of thing. One particular company I've integrated with breaks their API almost quarterly. If you often find yourself in a situation where the API breaks, even 1-2 times a year... I actually might recommend testing the API against an internalized test double. The internal mock gives you fast tests but importantly also becomes a check against which you can run the API. For APIs, testing is only worthwhile if you're interested in that second benefit. That said, it has a really nice benefit of making sure your mocked service comports with the interface of the service itself. It's a judgement call. As you mentioned, tracking down bugs in a 3rd party API is an utter nightmare.

Unfortunately I don't know a better way to mock an API than providing dummy results. These are the least fun tests to write but important to ensure stable interoperability. You should be using information-hiding to limit complexity at each level and hopefully after an abstraction or two you no longer need the API directly anyhow. If you don't have a test environment for the API at all I'd talk to the provider and/or consider moving to something else. At that point I'd even consider doing something in-house if necessary.