slice 1e-1f: tRPC router (auth + market.snapshot) + node:http server

auth.signup/login/logout/me with signed HMAC session cookies + scrypt hashing;
market.snapshot mega-endpoint (quote+candles+sector). node:http server mounts
tRPC at /api/trpc + /health + background drain loop. Live-verified: real NVDA
194.97/65 candles/Technology served after stale-while-revalidate drain. 36 tests green.

app/server/src/adapters/YFinanceAdapter.ts

@@ -15,7 +15,7 @@ export class YFinanceAdapter implements SourceFetch {
   private async yf(): Promise<YFinanceLike> {
     if (!this._yf) {
       const mod = await import('yahoo-finance2');
-      this._yf = new mod.default({ agent: undefined } as never);
+      this._yf = new mod.default();
     }
     return this._yf as YFinanceLike;
   }
@@ -71,7 +71,7 @@ export function parseCandles(raw: Record<string, unknown>): PriceCandle[] {
     const close = num(q.close);
     if (close === null) continue; // skip null candles (non-trading days / gaps)
     out.push({
-      ts: str(q.date) ?? '',
+      ts: q.date instanceof Date ? q.date.toISOString() : (typeof q.date === 'string' ? q.date : ''),
       o: num(q.open) ?? 0,
       h: num(q.high) ?? 0,
       l: num(q.low) ?? 0,