fix: require authentication on user-balance stats endpoint

[Dextheking1]

Summary

The /api/v1/dashboard/stats/user-balance route is registered directly on apiV1Router (internal/router/router.go:156), outside the dashboardRouter group that applies oauth.LoginRequired().

Its two sibling dashboard-stats routes are gated:

dashboardRouter := apiV1Router.Group("/dashboard")
dashboardRouter.Use(oauth.LoginRequired())
{
    dashboardRouter.GET("/stats/daily", dashboard.GetDailyStats)
    dashboardRouter.GET("/stats/top-customers", dashboard.GetTopCustomers)
}

apiV1Router.GET("/dashboard/stats/user-balance", dashboard.GetUserBalanceStats) // <-- not gated

As a result this endpoint is reachable unauthenticated and returns aggregate balance statistics over all users (total user count, and sum/avg/median/min/max/stddev of available_balance).

Fix

Move the route into the dashboardRouter group so it inherits oauth.LoginRequired(). The route path is unchanged (/api/v1/dashboard/stats/user-balance); only the middleware chain changes.

Impact

Low: the data is aggregate only (no per-user PII), but it discloses the size and distribution of the credit economy to anonymous callers, and it is inconsistent with the other dashboard routes.

Testing

gofmt parses cleanly. I could not run a full go build locally (the module requires Go 1.26; I have 1.22 available), but the change is a one-line relocation of an existing route registration into a sibling group already in scope.