SQL injection fixes on all 9 endpoints:
/api/trades: ISIN validated via regex, days range-checked
/api/summary, /api/statistics/total-trades: days range-checked
/api/custom-analytics: dates validated, exchanges whitelist-checked, already-existing enum validation kept
/api/statistics/moving-average: exchange whitelist-checked
/api/statistics/stock-trends: limit capped at 1000
/api/analytics: dates validated, ISINs validated, continents sanitized, metric/group_by whitelist-checked
/api/metadata/search: free-text query sanitized (quotes escaped, SQL fragments stripped)
80d8801728