feat: finalize root api.py with X-Auth-Secret auth security and clean pure sales cohort

scripts/clean_commercial_sales.py

@@ -0,0 +1,31 @@
+import sqlite3
+
+def clean_sales():
+    conn = sqlite3.connect('data/hiffi_catalog.db')
+    cur = conn.cursor()
+    
+    # Delete everything except the strictly verified pure sales records
+    cur.execute("""
+        DELETE FROM commercial_sales 
+        WHERE provenance_flag NOT IN ('VERIFIED_CSPC', 'VERIFIED_RIAA')
+    """)
+    deleted_count = cur.rowcount
+    
+    conn.commit()
+    
+    print(f"✅ Purged {deleted_count} unverified and streaming-based records.")
+    
+    # Verify the final clean state
+    print("\n--- Final Pure Sales Cohort ---")
+    cur.execute("SELECT provenance_flag, COUNT(*) FROM commercial_sales GROUP BY provenance_flag")
+    for flag, count in cur.fetchall():
+        print(f" - {flag}: {count} records")
+        
+    cur.execute("SELECT COUNT(*) FROM commercial_sales")
+    total = cur.fetchone()[0]
+    print(f"\nTotal Verified Pure Sales Records: {total} / 530 expected")
+    
+    conn.close()
+
+if __name__ == "__main__":
+    clean_sales()