fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/integrations/moex/moex.client.ts

@@ -123,22 +123,26 @@ export class MoexClient {
       rows.push(...current);
       if (!paginated) return rows;
       const cursorBlock = response[`${block}.cursor`];
-      if (!cursorBlock) {
+      if (cursorBlock === undefined) {
         if (current.length < FALLBACK_PAGE_SIZE) return rows;
         start += FALLBACK_PAGE_SIZE;
         continue;
       }
-      const cursor = parseRows(cursorBlock)[0];
+      const cursors = parseRows(cursorBlock);
+      const cursor = cursors[0];
       const index = integer(cursor?.index);
       const total = integer(cursor?.total);
       const pageSize = integer(cursor?.pagesize);
       if (
-        index === null ||
+        cursors.length !== 1 ||
+        index !== start ||
         total === null ||
         pageSize === null ||
-        index + pageSize >= total
+        pageSize === 0 ||
+        current.length !== Math.min(pageSize, total - start)
       )
-        return rows;
+        throw new ServiceUnavailableException({ code: 'MOEX_UNAVAILABLE' });
+      if (index + pageSize >= total) return rows;
       start = index + pageSize;
     }
   }
@@ -161,14 +165,13 @@ export class MoexClient {
 }
 
 function parseRows(block: IssBlock | undefined): Record<string, unknown>[] {
-  if (!block) return [];
-  if (!Array.isArray(block.columns) || !Array.isArray(block.data))
+  if (!Array.isArray(block?.columns) || !Array.isArray(block?.data))
     throw new ServiceUnavailableException({ code: 'MOEX_UNAVAILABLE' });
   const columns = block.columns;
   if (!columns.every((column) => typeof column === 'string'))
     throw new ServiceUnavailableException({ code: 'MOEX_UNAVAILABLE' });
   return block.data.map((values) => {
-    if (!Array.isArray(values))
+    if (!Array.isArray(values) || values.length !== columns.length)
       throw new ServiceUnavailableException({ code: 'MOEX_UNAVAILABLE' });
     return Object.fromEntries(
       columns.map((column, index) => [column.toLowerCase(), values[index]]),
@@ -191,6 +194,6 @@ function currencyText(value: unknown): string | null {
 }
 
 function integer(value: unknown): number | null {
-  const result = Number(value);
+  const result = Number(numberText(value) ?? NaN);
   return Number.isSafeInteger(result) && result >= 0 ? result : null;
 }