Api Annotations Get

A user's OWN ticker annotations.

SECURITY (SEC-IDOR, 2026-06-21): this endpoint USED to (a) take no auth and (b) read the legacy SQLite get_annotations(ticker), which has NO user_id column — so it commingled every user's private notes under a ticker and returned them to any caller (info disclosure of another user's research). The fix scopes the read to the SESSION user via the v111 per-user FK (pg_get_user_annotations), the read-side sibling of the §2.3/§2.4 write/delete helpers. The unscoped SQLite read is retired here — it cannot be made user-safe (no user_id), and PG is the authoritative store for this per-user surface. user_id comes from the session, NEVER request input.