fix: Lighter CancelStopOrders now filters by TriggerPrice, proxyBinance checks upstream status

- CancelStopOrders: only cancel orders with non-empty TriggerPrice (was canceling ALL orders including regular limit orders — safety bug)
- proxyBinance: return 502 when upstream returns non-200 instead of silently proxying error pages
- Remove redundant CORS headers in agent/web.go (already handled by gin middleware)

agent/web.go

@@ -122,15 +122,22 @@ func proxyBinance(rw http.ResponseWriter, url string) {
 		return
 	}
 	defer resp.Body.Close()
+
+	// Forward upstream error status codes instead of silently proxying bad data
+	if resp.StatusCode != http.StatusOK {
+		writeJSON(rw, 502, map[string]string{"error": fmt.Sprintf("upstream returned status %d", resp.StatusCode)})
+		return
+	}
+
 	rw.Header().Set("Content-Type", "application/json")
-	rw.Header().Set("Access-Control-Allow-Origin", "*")
+	// CORS is handled by the gin middleware — no need to set it here
 	// Limit response body to 2MB to prevent memory exhaustion
 	io.Copy(rw, io.LimitReader(resp.Body, 2*1024*1024))
 }
 
 func writeJSON(w http.ResponseWriter, status int, v interface{}) {
 	w.Header().Set("Content-Type", "application/json")
-	w.Header().Set("Access-Control-Allow-Origin", "*")
+	// CORS is handled by the gin middleware — no need to set it here
 	w.WriteHeader(status)
 	json.NewEncoder(w).Encode(v)
 }