fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/common/decorators/api-safe-error-response.decorator.ts

@@ -15,6 +15,12 @@ export class ProblemDetailsDto {
 
   @ApiProperty({
     required: false,
+    type: 'array',
+    items: {
+      type: 'object',
+      required: ['pointer', 'detail'],
+      properties: { pointer: { type: 'string' }, detail: { type: 'string' } },
+    },
     example: [{ pointer: '#/email', detail: 'must be a valid email address' }],
   })
   errors?: { pointer: string; detail: string }[];