feat(data): native Binance REST kline fetcher in 9 languages (#315)

Adds `BinanceRest::fetch_klines` to `wickra-data`: a blocking historical kline
downloader (`GET /api/v3/klines`) and the historical counterpart to the F4 live
`BinanceFeed`. It is the last native data-layer primitive needed to drop
third-party HTTP/JSON download helpers (`jackson`, `jsonlite`, `urllib`, …) from
the examples.

## What

- **Core** (`wickra-data`): `fetch_klines(symbol, interval, limit, start?, end?)`
  built on `ureq` with native-tls — sharing the exact same TLS backend
  (native-tls 0.2 / SChannel) as the existing tokio-tungstenite live feed, so the
  two pull one TLS stack, not two. Parses Binance's 12-element array rows via the
  existing serde infrastructure into validated `Candle`s. Blocking by design (a
  one-shot request needs no async runtime; the FFI boundary is synchronous
  anyway). Nine mock-HTTP-server tests cover parse / empty / limit / transport /
  JSON / invariant-violation paths.
- **C ABI**: `wickra_binance_fetch_klines(...)` (blocking drain into a caller
  buffer, `-1` on error) + regenerated cbindgen header and its vendored Go copy.
- **Bindings**: native Node `fetchBinanceKlines` / Python `fetch_binance_klines`;
  generated Go `FetchBinanceKlines` / C# `BinanceFeed.FetchKlines` / Java
  `BinanceFeed.fetchKlines` / R `fetch_binance_klines`. C / C++ call the C ABI
  directly. **WASM is excluded** (browsers use the host `fetch`).

The four C-ABI bindings are regenerated from the ScriptHelpers generators (not
hand-edited); the regen diff is exactly the new wrapper in each.

## Verification

All ten toolchains green locally: Rust (`cargo test`/`clippy`/`fmt`), Node, Python,
Go, C#, Java, R (`R CMD INSTALL` + smoke), WASM (`cargo check`, confirmed `ureq`
is not pulled). Each binding has an error-path smoke test; the parse/HTTP success
path is covered by the Rust mock-server tests.

No release in this PR — ships with the data-layer + numpy bundle later.

bindings/go/binance_test.go

@@ -18,3 +18,18 @@ func TestBinanceFeedRejectsBadParams(t *testing.T) {
 		t.Fatal("expected an error connecting to an unreachable endpoint")
 	}
 }
+
+// The REST fetcher's parse/HTTP success path is covered by the Rust
+// mock-HTTP-server tests in wickra-data; here we only assert the binding's
+// error paths, which need no reachable network.
+func TestFetchBinanceKlinesRejectsBadParams(t *testing.T) {
+	if _, err := FetchBinanceKlines("BTCUSDT", BinanceInterval(99), 1, -1, -1, ""); err == nil {
+		t.Fatal("expected an error for an unknown interval code")
+	}
+	if _, err := FetchBinanceKlines("BTCUSDT", OneHour, 0, -1, -1, ""); err == nil {
+		t.Fatal("expected an error for a zero limit")
+	}
+	if _, err := FetchBinanceKlines("BTCUSDT", OneHour, 1, -1, -1, "http://127.0.0.1:1"); err == nil {
+		t.Fatal("expected an error connecting to an unreachable endpoint")
+	}
+}

bindings/go/include/wickra.h

@@ -13773,6 +13773,15 @@ void wickra_binance_close(struct BinanceStream *handle);
 
 void wickra_binance_free(struct BinanceStream *handle);
 
+intptr_t wickra_binance_fetch_klines(const char *symbol,
+                                     uint8_t interval,
+                                     uint32_t limit,
+                                     int64_t start_ms,
+                                     int64_t end_ms,
+                                     const char *base_url,
+                                     struct WickraCandle *out,
+                                     uintptr_t cap);
+
 #ifdef __cplusplus
 }  // extern "C"
 #endif  // __cplusplus

bindings/go/indicators_gen.go

@@ -43431,3 +43431,32 @@ func (f *BinanceFeed) Close() {
 		runtime.SetFinalizer(f, nil)
 	}
 }
+
+// FetchBinanceKlines fetches historical klines from Binance's REST endpoint.
+// symbol is the trading pair (case-insensitive), interval the kline interval,
+// and limit the number of candles to request (1..=1000). startMs/endMs are
+// inclusive Unix-millisecond bounds (negative = unset); baseURL overrides the
+// host ("" = production https://api.binance.com). It blocks until the response
+// arrives and returns ErrInvalidParams on a bad argument or transport error.
+func FetchBinanceKlines(symbol string, interval BinanceInterval, limit uint32, startMs, endMs int64, baseURL string) ([]Candle, error) {
+	if limit == 0 {
+		return nil, ErrInvalidParams
+	}
+	csym := C.CString(symbol)
+	defer C.free(unsafe.Pointer(csym))
+	var curl *C.char
+	if baseURL != "" {
+		curl = C.CString(baseURL)
+		defer C.free(unsafe.Pointer(curl))
+	}
+	buf := make([]C.struct_WickraCandle, limit)
+	n := int(C.wickra_binance_fetch_klines(csym, C.uint8_t(interval), C.uint32_t(limit), C.int64_t(startMs), C.int64_t(endMs), curl, &buf[0], C.uintptr_t(limit)))
+	if n < 0 {
+		return nil, ErrInvalidParams
+	}
+	out := make([]Candle, n)
+	for i := 0; i < n; i++ {
+		out[i] = Candle{float64(buf[i].open), float64(buf[i].high), float64(buf[i].low), float64(buf[i].close), float64(buf[i].volume), int64(buf[i].timestamp)}
+	}
+	return out, nil
+}