OHLC bar service: turns a price stream into bars, stores them in a durable Postgres/Timescale store (with a reference MariaDB store readable for comparison), and serves them. Every route here is unauthenticated and CORS is open, so it must not be paired with cookies or bearer tokens without tightening that first. Six of the eight are pure reads of already-published bar data. Two are not, and are documented as such: `/ohlc-mt5-1m` tops a short minute tail up from the broker before it answers, and `POST /mt5-freshen-1m` does that top-up and nothing else — both write `bar_1m` and spend Manager API requests on a caller's behalf. That is why they are internal endpoints, and why a host with no MT5 credential cannot honour either promise. Timestamps are unix epoch in the store; there is no auth on this surface. Do not expose it on a public interface until that is settled.