Bug: Candles endpoint missing authentication

[FuturMix]

Description

GET /api/candles has no authentication check. Every other API route in the codebase calls authenticate(req), but this endpoint was missed.

Location

apps/web/src/app/api/candles/route.ts — GET handler

Impact

• Severity: HIGH
• Unauthenticated access to market data API
• Potential for rate-limit abuse against upstream exchange APIs
• Inconsistent with the auth pattern used in all other endpoints

Suggested Fix

Add the standard authenticate(req) call:

export async function GET(req: NextRequest) {
  const auth = await authenticate(req);
  if (!auth) return unauthorized();
  // ... rest of handler
}