fix(data-api): scope account stake-flow/stake-moves to hotkey or coldkey

[JSONbored]

Summary

• GET /api/v1/accounts/{ss58}/stake-flow and GET /api/v1/accounts/{ss58}/stake-moves filtered account_events on coldkey = $1 only.
• Any address that only ever appears as a hotkey (e.g. a validator receiving third-party delegations) got an all-zero flow/moves card even with real, current activity.
• Confirmed live: a validator hotkey with 1083 StakeAdded / 1106 StakeRemoved / 141 StakeMoved events (per the base /accounts/{ss58} route, which has always matched hotkey = $1 OR coldkey = $1) returned all zeros from both /stake-flow and /stake-moves.
• Fix: match both routes' WHERE clauses to the same (hotkey = $1 OR coldkey = $1) convention the base account route already uses.

Found during a full data-source audit following D1 retirement (unrelated to D1 -- this bug predates it and is purely a query-scoping issue in the Postgres tier).

Test plan

• npx vitest run tests/data-api.test.mjs -- 474/474 passing, including 2 new regression tests asserting the (hotkey = ? OR coldkey = ?) clause for both routes
• npx eslint / npx prettier --check clean
• Reproduced live pre-fix (curl against production showed the discrepancy), verified the query change against the exact failing address

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	metagraphed-data-api	1f6d8c2	Jul 17 2026, 12:43 PM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.85%. Comparing base (632d986) to head (1f6d8c2).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6504   +/-   ##
=======================================
  Coverage   97.85%   97.85%           
=======================================
  Files         174      174           
  Lines       22196    22196           
  Branches     8798     8798           
=======================================
  Hits        21721    21721           
  Misses         81       81           
  Partials      394      394           

Files with missing lines	Coverage Δ
workers/data-api.mjs	99.07% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 LoopOver is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}