feat: add 67 new endpoints across 10 feature groups

Prerequisite refactor:
- Consolidate duplicate _to_dicts into shared obb_utils.to_list
- Add fetch_historical and first_or_empty helpers to obb_utils

Phase 1 - Local computation (no provider risk):
- Group I: 12 technical indicators (ATR, ADX, Stoch, OBV, Ichimoku,
  Donchian, Aroon, CCI, Keltner, Fibonacci, A/D, Volatility Cones)
- Group J: Sortino, Omega ratios + rolling stats (variance, stdev,
  mean, skew, kurtosis, quantile via generic endpoint)
- Group H: ECB currency reference rates

Phase 2 - FRED/Federal Reserve providers:
- Group C: 10 fixed income endpoints (treasury rates, yield curve,
  auctions, TIPS, EFFR, SOFR, HQM, commercial paper, spot rates,
  spreads)
- Group D: 11 economy endpoints (CPI, GDP, unemployment, PCE, money
  measures, CLI, HPI, FRED search, balance of payments, Fed holdings,
  FOMC documents)
- Group E: 5 survey endpoints (Michigan, SLOOS, NFP, Empire State,
  BLS search)

Phase 3 - SEC/stockgrid/FINRA providers:
- Group B: 4 equity fundamental endpoints (management, dividends,
  SEC filings, company search)
- Group A: 4 shorts/dark pool endpoints (short volume, FTD, short
  interest, OTC dark pool)
- Group F: 3 index/ETF enhanced (S&P 500 multiples, index
  constituents, ETF N-PORT)

Phase 4 - Regulators:
- Group G: 5 regulatory endpoints (COT report, COT search, SEC
  litigation, institution search, CIK mapping)

Security hardening:
- Service-layer allowlists for all getattr dynamic dispatch
- Regex validation on date, country, security_type, form_type params
- Exception handling in fetch_historical
- Callable guard on rolling stat dispatch

Total: 32 existing + 67 new = 99 endpoints, all free providers.

routes_market.py

@@ -135,3 +135,45 @@ async def futures_curve(symbol: str = Path(..., min_length=1, max_length=20)):
     symbol = validate_symbol(symbol)
     data = await market_service.get_futures_curve(symbol)
     return ApiResponse(data=data)
+
+
+# --- Currency Reference Rates (Group H) ---
+
+
+@router.get("/currency/reference-rates", response_model=ApiResponse)
+@safe
+async def currency_reference_rates():
+    """Get ECB reference exchange rates for 28 major currencies."""
+    data = await market_service.get_currency_reference_rates()
+    return ApiResponse(data=data)
+
+
+# --- Index Enhanced (Group F) ---
+
+
+@router.get("/index/sp500-multiples", response_model=ApiResponse)
+@safe
+async def sp500_multiples(
+    series: str = Query(default="pe_ratio", pattern="^[a-z_]+$"),
+):
+    """Historical S&P 500 valuation: pe_ratio, shiller_pe_ratio, dividend_yield, etc."""
+    data = await market_service.get_sp500_multiples(series)
+    return ApiResponse(data=data)
+
+
+@router.get("/index/{symbol}/constituents", response_model=ApiResponse)
+@safe
+async def index_constituents(symbol: str = Path(..., min_length=1, max_length=20)):
+    """Get index member stocks with sector and price data."""
+    symbol = validate_symbol(symbol)
+    data = await market_service.get_index_constituents(symbol)
+    return ApiResponse(data=data)
+
+
+@router.get("/etf/{symbol}/nport", response_model=ApiResponse)
+@safe
+async def etf_nport(symbol: str = Path(..., min_length=1, max_length=20)):
+    """Detailed ETF holdings from SEC N-PORT filings."""
+    symbol = validate_symbol(symbol)
+    data = await market_service.get_etf_nport(symbol)
+    return ApiResponse(data=data)