Cancel all of the authenticated user's open orders on an exchange

Kill-switch endpoint: cancels every open order the caller has on exchange_id (optionally scoped further to a single market_id) via the venue's native cancel-all call, then reconciles local Order rows up to however many the venue actually reported cancelled. If the venue reports 0 cancellations, no local rows are touched — a mismatch between "0 cancelled" and locally-tracked active orders is reconciled automatically in the background rather than being blindly marked cancelled. Unlike POST /orders/{order_id}/cancel and POST /orders/cancel-batch, input errors here (e.g. an unsupported exchange_id) surface as a real 400, not a success: false 200 — this is the kill-switch path, so a caller-input problem must be visibly distinct from "the venue kept orders resting." Auth & scope. Requires trade:execute.