feat(finance): export watchlists as a CSV with prices, ticker leftmost

[ralyodio]

Export (single list and all lists) now writes a spreadsheet-shaped CSV: a header row, then one row per stock with the symbol leftmost and its market data alongside.

Symbol,List,Price,Change,Change %,1D %,5D %,30D %,Open,High,Low,Prev Close,Volume,As Of
XOM,Energy,98.10,0.44,0.45,0.45,1.20,-2.10,97.80,98.40,97.55,97.66,12345600,2026-08-01
AAPL,Tech,123.46,-1.20,-0.96,-0.96,2.12,,124.00,125.00,122.50,124.66,54321000,2026-08-01

• Prices come from /api/finance/quotes + /api/finance/watchlist/changes, fetched in 60-symbol chunks since both routes cap a request there. A failed chunk leaves those cells blank rather than sinking the file.
• Import reads the Symbol / List columns back, ignores price columns and tolerates extra ones, so a file edited in a spreadsheet still restores. Blank List cell (or no List column) falls back to the file name.
• Files in the previous #watchlists format still import.
• Lists are grouped and sorted by name; tickers alphabetical within each. An empty list keeps a blank-symbol row so it survives a round trip.

Helpers are pure and unit-tested (39 tests in watchlist.test.ts). No API or schema changes.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

225 finding(s)

HIGH/CRITICAL: 137 | MEDIUM: 88

Severity	Rule	Location
HIGH	secret-private-key	src/app/settings/seedbox-section.tsx:354
HIGH	secret-generic-api-key	docs/incidents/2026-05-okshanaby-supply-chain.md:18
HIGH	tls-verification-disabled	docs/tunein (2).py:34
HIGH	tls-verification-disabled	docs/tunein (2).py:37
HIGH	tls-verification-disabled	docs/tunein.py:34
HIGH	tls-verification-disabled	docs/tunein.py:37
HIGH	manifest-typosquat	package.json:85
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:37
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:65
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:87
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:88
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:112
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:134
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:135
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:158
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:188
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:213
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:70
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:71
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:119
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:120
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:171
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:172
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:193
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:194
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:213
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:214
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:231
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:232
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:251
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:252
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:269
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:270
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:289
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:290
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:37
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:65
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:123
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:164
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:173
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:196
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:221
HIGH	secret-generic-credential	src/app/api/cron/expire-subscriptions/route.test.ts:56
HIGH	secret-generic-credential	src/app/api/cron/expire-subscriptions/route.test.ts:62
HIGH	secret-generic-credential	src/app/api/ice/turn/route.test.ts:18
HIGH	secret-generic-credential	src/app/api/iptv/playlists/route.test.ts:39
HIGH	secret-generic-credential	src/app/api/iptv/subscription/route.test.ts:66
HIGH	secret-generic-credential	src/app/api/webhooks/coinpayportal/route.test.ts:26
HIGH	secret-generic-credential	src/app/api/youtube/search/route.test.ts:45
HIGH	secret-generic-credential	src/app/api/youtube/search/route.test.ts:46

…and 175 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.