security: exclude flexoptix-marketplace data from all public API endpoints

Public price-comparison and hot-topics routes previously had no filter
for the flexoptix/flexoptix-selfconfigure/flexoptix-msrp marketplaces.
Flexoptix API data is customer-confidential and must not leave the system.

Adds marketplace NOT LIKE flexoptix% filter to:
- /api/price-comparison (top-50 CTE)
- /api/price-comparison/summary (both CTEs)
- /api/price-comparison/:sku (per-vendor subquery)
- /api/hot-topics price_drops query (vendor name filter)

packages/api/src/routes/hot-topics.ts

@@ -50,6 +50,7 @@ hotTopicsRouter.get("/", async (req, res) => {
       JOIN vendors v ON pc.vendor_id = v.id
       JOIN transceivers t ON pc.transceiver_id = t.id
       WHERE pc.delta_pct < -10 AND pc.detected_at > NOW() - INTERVAL '14 days'
+        AND v.name != 'Flexoptix'
       ORDER BY pc.delta_pct ASC LIMIT 5
     `).catch(() => ({ rows: [] }));
 

packages/api/src/routes/price-comparison.ts

@@ -36,6 +36,7 @@ priceComparisonRouter.get("/summary", async (_req: Request, res: Response) => {
             po.price,
             po.currency
           FROM price_observations po
+          WHERE po.marketplace NOT LIKE 'flexoptix%'
           ORDER BY po.transceiver_id, po.source_vendor_id, po.time DESC
         )
         SELECT
@@ -55,6 +56,7 @@ priceComparisonRouter.get("/summary", async (_req: Request, res: Response) => {
             po.price,
             po.currency
           FROM price_observations po
+          WHERE po.marketplace NOT LIKE 'flexoptix%'
           ORDER BY po.transceiver_id, po.source_vendor_id, po.time DESC
         )
         SELECT
@@ -110,6 +112,7 @@ priceComparisonRouter.get("/", async (req: Request, res: Response) => {
           po.price,
           po.currency
         FROM price_observations po
+        WHERE po.marketplace NOT LIKE 'flexoptix%'
         ORDER BY po.transceiver_id, po.source_vendor_id, po.time DESC
       )
       SELECT
@@ -216,6 +219,7 @@ priceComparisonRouter.get("/:sku", async (req: Request, res: Response) => {
           po.time
         FROM price_observations po
         WHERE po.transceiver_id = $1
+          AND po.marketplace NOT LIKE 'flexoptix%'
         ORDER BY po.transceiver_id, po.source_vendor_id, po.time DESC
       ) po
       JOIN vendors v ON v.id = po.source_vendor_id