Lighter sub-wallet realized PnL (24h / 7d / 30d)

GET /v1/perps/lighter-pnl

Rolling realized PnL for a Lighter sub-wallet, fetched from Lighter's first-class /api/v1/pnl endpoint (1h + 1d resolutions). The handler owns the encrypted-bearer handshake against Minara's /v1/tx/perps/lighter-authorization (RSA-OAEP-256 + AES-256-GCM) so the web UI calls one clean endpoint and gets back { d1, d7, d30, connected }. Each window value is null when Lighter has no data inside it — the Portfolio Perps Value card renders — for nulls. Fail-open: any step (sub-account lookup, authorization fetch, decrypt, Lighter HTTP call) degrades to per-window null with a warn log. HL-bound sub-wallets aren't this endpoint's audience — they use the trade + funding feeds client-side; calling this with an HL ?wallet= returns the empty envelope.