Return a paginated list of the authenticated user's backtests.

P1-F2: refused (403, friendly) for the SHARED guest key with no session — all anonymous visitors resolve to the one demo tenant, so this list would hand a visitor every other visitor's runs. Submitting a run and polling it by run_id still work.

Auth: same effective-user resolution as POST /v1/backtests (require_backtest_submitter — session cookie wins when present, else X-Vega-Key). Keeps the list scoped to whichever principal actually owns the rows the caller expects to see.

Fix wave (Phase D, Fix 1): every row carries kind ('single' | 'portfolio' | 'walkforward' | 'ensemble') so a list UI can route each row to the right renderer without a per-row fetch (a portfolio / walkforward / ensemble row has no real key). Optional ?kind= filters to one row type; public values are "backtest" (single-strategy, POST /v1/backtests), "portfolio" (POST /v1/portfolio/backtests), "walkforward" (#38, POST /v1/backtests/walkforward) and "ensemble" (#39, POST /v1/backtests/ensemble) — "backtest" maps internally to the db's 'single'. Any other value is a 422, not silently ignored. Default (omitted) = all kinds, unchanged from before this fix.