feat(data): native Binance REST kline fetcher in 9 languages (#315)

Adds `BinanceRest::fetch_klines` to `wickra-data`: a blocking historical kline
downloader (`GET /api/v3/klines`) and the historical counterpart to the F4 live
`BinanceFeed`. It is the last native data-layer primitive needed to drop
third-party HTTP/JSON download helpers (`jackson`, `jsonlite`, `urllib`, …) from
the examples.

## What

- **Core** (`wickra-data`): `fetch_klines(symbol, interval, limit, start?, end?)`
  built on `ureq` with native-tls — sharing the exact same TLS backend
  (native-tls 0.2 / SChannel) as the existing tokio-tungstenite live feed, so the
  two pull one TLS stack, not two. Parses Binance's 12-element array rows via the
  existing serde infrastructure into validated `Candle`s. Blocking by design (a
  one-shot request needs no async runtime; the FFI boundary is synchronous
  anyway). Nine mock-HTTP-server tests cover parse / empty / limit / transport /
  JSON / invariant-violation paths.
- **C ABI**: `wickra_binance_fetch_klines(...)` (blocking drain into a caller
  buffer, `-1` on error) + regenerated cbindgen header and its vendored Go copy.
- **Bindings**: native Node `fetchBinanceKlines` / Python `fetch_binance_klines`;
  generated Go `FetchBinanceKlines` / C# `BinanceFeed.FetchKlines` / Java
  `BinanceFeed.fetchKlines` / R `fetch_binance_klines`. C / C++ call the C ABI
  directly. **WASM is excluded** (browsers use the host `fetch`).

The four C-ABI bindings are regenerated from the ScriptHelpers generators (not
hand-edited); the regen diff is exactly the new wrapper in each.

## Verification

All ten toolchains green locally: Rust (`cargo test`/`clippy`/`fmt`), Node, Python,
Go, C#, Java, R (`R CMD INSTALL` + smoke), WASM (`cargo check`, confirmed `ureq`
is not pulled). Each binding has an error-path smoke test; the parse/HTTP success
path is covered by the Rust mock-server tests.

No release in this PR — ships with the data-layer + numpy bundle later.

bindings/java/src/main/java/org/wickra/BinanceFeed.java

@@ -81,6 +81,51 @@ public final class BinanceFeed implements AutoCloseable {
         }
     }
 
+    /** Fetch historical klines from Binance's REST endpoint. symbol is the
+     *  trading pair (case-insensitive), limit the number of candles (1..=1000).
+     *  startMs/endMs are inclusive Unix-millisecond bounds (negative = unset);
+     *  baseUrl overrides the host (null = production). Blocks until done. */
+    public static Candle[] fetchKlines(String symbol, BinanceInterval interval, int limit,
+                                       long startMs, long endMs, String baseUrl) {
+        if (symbol == null) {
+            throw new NullPointerException("symbol");
+        }
+        if (limit <= 0) {
+            throw new IllegalArgumentException("limit must be in 1..=1000");
+        }
+        try (Arena a = Arena.ofConfined()) {
+            byte[] sb = symbol.getBytes(StandardCharsets.UTF_8);
+            MemorySegment sym = a.allocate(sb.length + 1L);
+            MemorySegment.copy(sb, 0, sym, JAVA_BYTE, 0L, sb.length);
+            MemorySegment url = MemorySegment.NULL;
+            if (baseUrl != null) {
+                byte[] ub = baseUrl.getBytes(StandardCharsets.UTF_8);
+                url = a.allocate(ub.length + 1L);
+                MemorySegment.copy(ub, 0, url, JAVA_BYTE, 0L, ub.length);
+            }
+            MemorySegment out = a.allocate(48L * limit);
+            long n = (long) NativeMethods.WICKRA_BINANCE_FETCH_KLINES.invokeExact(
+                sym, (byte) interval.ordinal(), limit, startMs, endMs, url, out, (long) limit);
+            if (n < 0) {
+                throw new IllegalArgumentException("invalid fetchKlines parameters or transport error");
+            }
+            Candle[] result = new Candle[(int) n];
+            for (int i = 0; i < n; i++) {
+                long b = (long) i * 48L;
+                result[i] = new Candle(
+                    out.get(JAVA_DOUBLE, b + 0L),
+                    out.get(JAVA_DOUBLE, b + 8L),
+                    out.get(JAVA_DOUBLE, b + 16L),
+                    out.get(JAVA_DOUBLE, b + 24L),
+                    out.get(JAVA_DOUBLE, b + 32L),
+                    (double) out.get(JAVA_LONG, b + 40L));
+            }
+            return result;
+        } catch (Throwable t) {
+            throw WickraNative.rethrow(t);
+        }
+    }
+
     @Override public void close() {
         try {
             NativeMethods.WICKRA_BINANCE_CLOSE.invokeExact(handle);

bindings/java/src/main/java/org/wickra/internal/NativeMethods.java

@@ -3963,6 +3963,7 @@ public final class NativeMethods {
     public static MethodHandle WICKRA_BINANCE_NEXT;
     public static MethodHandle WICKRA_BINANCE_CLOSE;
     public static MethodHandle WICKRA_BINANCE_FREE;
+    public static MethodHandle WICKRA_BINANCE_FETCH_KLINES;
 
     static {
         init0();
@@ -8047,6 +8048,7 @@ public final class NativeMethods {
         WICKRA_BINANCE_NEXT = h("wickra_binance_next", FunctionDescriptor.of(JAVA_INT, ADDRESS, ADDRESS, JAVA_LONG));
         WICKRA_BINANCE_CLOSE = h("wickra_binance_close", FunctionDescriptor.ofVoid(ADDRESS));
         WICKRA_BINANCE_FREE = h("wickra_binance_free", FunctionDescriptor.ofVoid(ADDRESS));
+        WICKRA_BINANCE_FETCH_KLINES = h("wickra_binance_fetch_klines", FunctionDescriptor.of(JAVA_LONG, ADDRESS, JAVA_BYTE, JAVA_INT, JAVA_LONG, JAVA_LONG, ADDRESS, ADDRESS, JAVA_LONG));
     }
 
 }

bindings/java/src/test/java/org/wickra/BinanceFeedTest.java

@@ -21,4 +21,18 @@ class BinanceFeedTest {
         assertThrows(IllegalArgumentException.class,
             () -> new BinanceFeed("BTCUSDT", BinanceInterval.ONE_MINUTE, "ws://127.0.0.1:1"));
     }
+
+    // The REST fetcher's parse/HTTP success path is covered by the Rust
+    // mock-HTTP-server tests; here we only assert the binding's error paths.
+    @Test
+    void fetchKlinesRejectsZeroLimit() {
+        assertThrows(IllegalArgumentException.class,
+            () -> BinanceFeed.fetchKlines("BTCUSDT", BinanceInterval.ONE_HOUR, 0, -1L, -1L, null));
+    }
+
+    @Test
+    void fetchKlinesSurfacesUnreachableEndpoint() {
+        assertThrows(IllegalArgumentException.class,
+            () -> BinanceFeed.fetchKlines("BTCUSDT", BinanceInterval.ONE_HOUR, 1, -1L, -1L, "http://127.0.0.1:1"));
+    }
 }