fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/modules/banking/bank-cards/domain/bank-card.calculations.spec.ts

@@ -116,7 +116,9 @@ describe('bank card calculations', () => {
         amountKopecks: 5000n,
       },
     ];
-    expect(bankSummary('2026-09', operations)).toEqual({
+    expect(
+      bankSummary({ from: '2026-09-01', to: '2026-09-30' }, operations),
+    ).toEqual({
       expenses: 120n,
       refunds: 500n,
       net: -380n,
@@ -125,7 +127,9 @@ describe('bank card calculations', () => {
         { categoryId: 'travel', expenses: 20n, refunds: 0n, net: 20n },
       ],
     });
-    expect(bankSummary('2026-07', operations)).toEqual({
+    expect(
+      bankSummary({ from: '2026-07-01', to: '2026-07-31' }, operations),
+    ).toEqual({
       expenses: 0n,
       refunds: 0n,
       net: 0n,
@@ -141,7 +145,12 @@ describe('bank card calculations', () => {
       amountKopecks: 2n ** 63n - 1n,
     };
     const total = 2n * (2n ** 63n - 1n);
-    expect(bankSummary('2026-09', [operation, operation])).toEqual({
+    expect(
+      bankSummary({ from: '2026-09-01', to: '2026-09-30' }, [
+        operation,
+        operation,
+      ]),
+    ).toEqual({
       expenses: total,
       refunds: 0n,
       net: total,