fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/modules/auth/presentation/auth.controller.ts

@@ -87,7 +87,7 @@ export class AuthController {
       if (!token) throw new UnauthorizedException({ code: 'UNAUTHORIZED' });
       return this.respond(response, await this.auth.refresh(token));
     } catch (error) {
-      this.clearCookie(response);
+      if (error instanceof UnauthorizedException) this.clearCookie(response);
       throw error;
     }
   }