feat(finance): export every watchlist to one file, and import it back

[ralyodio]

Follow-up to #162 / #163: Export all downloads every list in a single file.

Format — watchlists.csv:

#watchlists
Energy,XOM
Tech,AAPL,NVDA

One line per list, lists sorted by name, tickers alphabetical (same as the single-list export). Empty lists are preserved. Names containing commas or quotes are CSV-quoted ("Big, ""risky"" names",SPY).

Why the #watchlists header — without a sentinel, a multi-line file is ambiguous: is the first field of each line a list name or a ticker? The header lets Import tell an all-lists export from a plain ticker file with no guessing. Files without it keep the current behavior (one new list named after the file), so nothing about #163 changes.

Import restores each line as its own list, name-collision suffixes applied per #163 — so re-importing your own export gives Tech 2, not a merge into Tech.

Export-all fetches each list's items on demand (only the active list is held in state); no API or schema changes. New pure helpers formatWatchlistsExport / parseWatchlistsExport with round-trip tests, including quoted names, empty lists, CRLF, and junk tickers.

Checks: pnpm typecheck clean, pnpm build compiles, full suite 2538 passed / 7 skipped. Lint: 0 errors (5 pre-existing react-hooks/set-state-in-effect warnings).

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

225 finding(s)

HIGH/CRITICAL: 137 | MEDIUM: 88

Severity	Rule	Location
HIGH	secret-private-key	src/app/settings/seedbox-section.tsx:354
HIGH	secret-generic-api-key	docs/incidents/2026-05-okshanaby-supply-chain.md:18
HIGH	tls-verification-disabled	docs/tunein (2).py:34
HIGH	tls-verification-disabled	docs/tunein (2).py:37
HIGH	tls-verification-disabled	docs/tunein.py:34
HIGH	tls-verification-disabled	docs/tunein.py:37
HIGH	manifest-typosquat	package.json:85
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:37
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:65
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:87
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:88
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:112
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:134
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:135
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:158
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:188
HIGH	secret-generic-credential	src/app/api/auth/login/route.test.ts:213
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:70
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:71
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:119
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:120
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:171
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:172
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:193
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:194
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:213
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:214
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:231
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:232
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:251
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:252
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:269
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:270
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:289
HIGH	secret-generic-credential	src/app/api/auth/me/route.test.ts:290
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:37
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:65
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:123
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:164
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:173
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:196
HIGH	secret-generic-credential	src/app/api/auth/signup/route.test.ts:221
HIGH	secret-generic-credential	src/app/api/cron/expire-subscriptions/route.test.ts:56
HIGH	secret-generic-credential	src/app/api/cron/expire-subscriptions/route.test.ts:62
HIGH	secret-generic-credential	src/app/api/ice/turn/route.test.ts:18
HIGH	secret-generic-credential	src/app/api/iptv/playlists/route.test.ts:39
HIGH	secret-generic-credential	src/app/api/iptv/subscription/route.test.ts:66
HIGH	secret-generic-credential	src/app/api/webhooks/coinpayportal/route.test.ts:26
HIGH	secret-generic-credential	src/app/api/youtube/search/route.test.ts:45
HIGH	secret-generic-credential	src/app/api/youtube/search/route.test.ts:46

…and 175 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.