fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/modules/auth/application/auth.service.ts

@@ -29,9 +29,8 @@ export class AuthService {
     email: string,
     password: string,
   ): Promise<{ user: AuthUser; accessToken: string; refreshToken: string }> {
-    const normalizedEmail = this.normalizeEmail(email);
     const existing = await this.prisma.user.findUnique({
-      where: { email: normalizedEmail },
+      where: { email },
     });
     if (existing)
       throw new ConflictException({ code: 'EMAIL_ALREADY_REGISTERED' });
@@ -41,7 +40,7 @@ export class AuthService {
       user = await this.prisma.user.create({
         data: {
           id: randomUUID(),
-          email: normalizedEmail,
+          email,
           passwordHash: await bcrypt.hash(password, PASSWORD_HASH_ROUNDS),
         },
       });
@@ -58,7 +57,7 @@ export class AuthService {
     password: string,
   ): Promise<{ user: AuthUser; accessToken: string; refreshToken: string }> {
     const user = await this.prisma.user.findUnique({
-      where: { email: this.normalizeEmail(email) },
+      where: { email },
     });
     const valid = await bcrypt.compare(
       password,
@@ -103,26 +102,27 @@ export class AuthService {
 
   async logout(token?: string): Promise<void> {
     if (!token) return;
+    let payload: RefreshPayload;
     try {
-      const payload = await this.jwt.verifyAsync<RefreshPayload>(token, {
+      payload = await this.jwt.verifyAsync<RefreshPayload>(token, {
         algorithms: ['HS256'],
       });
-      if (payload.type !== 'refresh') return;
-      const session = await this.prisma.session.findUnique({
-        where: { id: payload.sid },
-      });
-      if (
-        session &&
-        !session.revokedAt &&
-        session.refreshTokenHash === this.hash(token)
-      ) {
-        await this.prisma.session.update({
-          where: { id: session.id },
-          data: { revokedAt: new Date() },
-        });
-      }
     } catch {
-      // Logout is intentionally idempotent.
+      return;
+    }
+    if (payload.type !== 'refresh') return;
+    const session = await this.prisma.session.findUnique({
+      where: { id: payload.sid },
+    });
+    if (
+      session &&
+      !session.revokedAt &&
+      session.refreshTokenHash === this.hash(token)
+    ) {
+      await this.prisma.session.update({
+        where: { id: session.id },
+        data: { revokedAt: new Date() },
+      });
     }
   }
 
@@ -187,10 +187,6 @@ export class AuthService {
     };
   }
 
-  private normalizeEmail(email: string): string {
-    return email;
-  }
-
   private hash(token: string): string {
     return createHash('sha256').update(token).digest('hex');
   }