fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/integrations/tbank/tbank-account.policy.spec.ts

@@ -1,7 +1,4 @@
-import {
-  accessibleTbankAccount,
-  supportedTbankAccounts,
-} from './tbank-account.policy';
+import { supportedTbankAccounts } from './tbank-account.policy';
 
 describe('tbank-account-policy', () => {
   it('normalizes supported account types and fallback names', () => {
@@ -45,26 +42,4 @@ describe('tbank-account-policy', () => {
       },
     ]);
   });
-
-  it('matches account-scoped access only for supported account types', () => {
-    expect(
-      accessibleTbankAccount(
-        [
-          { id: 'account', type: 'ACCOUNT_TYPE_DEBIT', name: 'Debit' },
-          { id: 'other', type: 'ACCOUNT_TYPE_TINKOFF', name: 'Other' },
-        ],
-        'account',
-      ),
-    ).toBeNull();
-    expect(
-      accessibleTbankAccount(
-        [{ id: 'account', type: 'ACCOUNT_TYPE_TINKOFF', name: 'Brokerage' }],
-        'account',
-      ),
-    ).toEqual({
-      id: 'account',
-      type: 'ACCOUNT_TYPE_TINKOFF',
-      name: 'Brokerage',
-    });
-  });
 });