feat(data): native Binance REST kline fetcher in 9 languages (#315)

Adds `BinanceRest::fetch_klines` to `wickra-data`: a blocking historical kline
downloader (`GET /api/v3/klines`) and the historical counterpart to the F4 live
`BinanceFeed`. It is the last native data-layer primitive needed to drop
third-party HTTP/JSON download helpers (`jackson`, `jsonlite`, `urllib`, …) from
the examples.

## What

- **Core** (`wickra-data`): `fetch_klines(symbol, interval, limit, start?, end?)`
  built on `ureq` with native-tls — sharing the exact same TLS backend
  (native-tls 0.2 / SChannel) as the existing tokio-tungstenite live feed, so the
  two pull one TLS stack, not two. Parses Binance's 12-element array rows via the
  existing serde infrastructure into validated `Candle`s. Blocking by design (a
  one-shot request needs no async runtime; the FFI boundary is synchronous
  anyway). Nine mock-HTTP-server tests cover parse / empty / limit / transport /
  JSON / invariant-violation paths.
- **C ABI**: `wickra_binance_fetch_klines(...)` (blocking drain into a caller
  buffer, `-1` on error) + regenerated cbindgen header and its vendored Go copy.
- **Bindings**: native Node `fetchBinanceKlines` / Python `fetch_binance_klines`;
  generated Go `FetchBinanceKlines` / C# `BinanceFeed.FetchKlines` / Java
  `BinanceFeed.fetchKlines` / R `fetch_binance_klines`. C / C++ call the C ABI
  directly. **WASM is excluded** (browsers use the host `fetch`).

The four C-ABI bindings are regenerated from the ScriptHelpers generators (not
hand-edited); the regen diff is exactly the new wrapper in each.

## Verification

All ten toolchains green locally: Rust (`cargo test`/`clippy`/`fmt`), Node, Python,
Go, C#, Java, R (`R CMD INSTALL` + smoke), WASM (`cargo check`, confirmed `ureq`
is not pulled). Each binding has an error-path smoke test; the parse/HTTP success
path is covered by the Rust mock-server tests.

No release in this PR — ships with the data-layer + numpy bundle later.

crates/wickra-data/Cargo.toml

@@ -38,11 +38,22 @@ tokio = { version = "1", features = ["rt", "rt-multi-thread", "macros", "net", "
 tokio-tungstenite = { version = "0.29", optional = true, features = ["native-tls"] }
 futures-util = { version = "0.3", optional = true }
 url = { version = "2", optional = true }
+# Blocking HTTP client for the historical REST kline fetcher. ureq 2.x with
+# native-tls verifies against the OS trust store (SChannel / Security.framework /
+# OpenSSL) — the same backend tokio-tungstenite uses above — so it ships no
+# bundled CA roots. (ureq 3.x hard-depends on `webpki-root-certs` regardless of
+# TLS backend, which is CDLA-Permissive-2.0 and dead weight under native-tls.)
+ureq = { version = "2", default-features = false, features = ["native-tls"], optional = true }
+# Direct dependency so the agent can be built with a native-tls connector (ureq
+# 2.x does not auto-configure native-tls). Already in the tree via tokio-tungstenite.
+native-tls = { version = "0.2", optional = true }
 
 [features]
 default = []
-# Each exchange is gated so users only pay for the WS stack they actually want.
-live-binance = ["dep:tokio", "dep:tokio-tungstenite", "dep:futures-util", "dep:url"]
+# Each exchange is gated so users only pay for the WS/REST stack they actually
+# want. `live-binance` covers both the live WebSocket feed and the historical
+# REST kline fetcher.
+live-binance = ["dep:tokio", "dep:tokio-tungstenite", "dep:futures-util", "dep:url", "dep:ureq", "dep:native-tls"]
 
 [dev-dependencies]
 approx = { workspace = true }