feat: scope candles/annotations/export APIs by chartId query param

- GET /api/candles accepts ?chartId= with fallback to most recent chart
- GET /api/annotations accepts ?chartId= with fallback to most recent chart
- POST /api/annotations now requires chart_id in request body
- GET /api/export accepts ?chartId= to scope exported annotations
- DELETE /api/annotations supports optional chartId scoping

src/app/api/candles/route.ts

@@ -1,13 +1,32 @@
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 import { db } from '@/lib/db';
-import { candles } from '@/lib/db/schema';
-import { asc } from 'drizzle-orm';
+import { candles, charts } from '@/lib/db/schema';
+import { asc, desc, eq } from 'drizzle-orm';
 
-export async function GET() {
+export async function GET(request: NextRequest) {
   try {
+    const { searchParams } = request.nextUrl;
+    let chartId = searchParams.get('chartId');
+
+    // Fall back to most recent chart if no chartId provided
+    if (!chartId) {
+      const latest = await db.select({ id: charts.id }).from(charts).orderBy(desc(charts.created_at)).limit(1);
+      if (latest.length === 0) {
+        return NextResponse.json([]);
+      }
+      chartId = String(latest[0].id);
+    }
+
     const allCandles = await db
-      .select()
+      .select({
+        time: candles.time,
+        open: candles.open,
+        high: candles.high,
+        low: candles.low,
+        close: candles.close,
+      })
       .from(candles)
+      .where(eq(candles.chart_id, parseInt(chartId, 10)))
       .orderBy(asc(candles.time));
 
     return NextResponse.json(allCandles);