feat(finance): import/export watchlists as comma-separated tickers

[ralyodio]

Adds Import / Export to the watchlist section on the finance page.

• Export — downloads the active list's tickers as comma-separated, alphabetical text (<list-name>.csv, e.g. AAPL,NVDA,SPY,TSLA). Disabled when the list is empty.
• Import — picks a .csv/.txt file, reads it, and adds its symbols to the active list via the existing POST /api/finance/watchlist bulk-add endpoint, so parsing/normalization/dedupe and the "skipped N invalid" feedback all stay in one place. Re-selecting the same file works (input is reset).

Two pure helpers in src/lib/finance/watchlist.ts: formatSymbolsCsv (normalize → dedupe → sort → join) and watchlistExportFilename (slugify the list name). Both covered by unit tests, including a round-trip through parseSymbolList.

No schema or API changes.

Checks: pnpm typecheck clean, pnpm build succeeds, full suite 2523 passed / 7 skipped. Lint shows only the 5 pre-existing react-hooks/set-state-in-effect warnings in this file.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

224 finding(s)

HIGH/CRITICAL: 137 | MEDIUM: 87

Severity	Rule	Location
HIGH	secret-private-key	src/app/settings/seedbox-section.tsx:354
HIGH	secret-generic-api-key	docs/incidents/2026-05-okshanaby-supply-chain.md:18
HIGH	tls-verification-disabled	docs/tunein (2).py:34
HIGH	tls-verification-disabled	docs/tunein (2).py:37
HIGH	tls-verification-disabled	docs/tunein.py:34
HIGH	tls-verification-disabled	docs/tunein.py:37
HIGH	manifest-typosquat	package.json:85
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:37
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:65
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:87
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:88
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:112
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:134
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:135
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:158
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:188
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:213
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:70
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:71
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:119
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:120
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:171
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:172
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:193
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:194
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:213
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:214
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:231
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:232
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:251
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:252
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:269
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:270
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:289
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:290
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:37
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:65
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:123
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:164
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:173
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:196
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:221
HIGH	secret-generic-credential	src/app/api/cron/expire-subscriptions/route.test.ts:56
HIGH	secret-generic-credential	src/app/api/cron/expire-subscriptions/route.test.ts:62
HIGH	secret-generic-credential	src/app/api/ice/turn/route.test.ts:18
HIGH	secret-generic-credential	src/app/api/iptv/playlists/route.test.ts:39
HIGH	secret-generic-credential	src/app/api/iptv/subscription/route.test.ts:66
HIGH	secret-generic-credential	src/app/api/webhooks/coinpayportal/route.test.ts:26
HIGH	secret-generic-credential	src/app/api/youtube/search/route.test.ts:45
HIGH	secret-generic-credential	src/app/api/youtube/search/route.test.ts:46

…and 174 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.