fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/modules/banking/bank-cards/domain/bank-card.calculations.ts

@@ -1,6 +1,5 @@
 import { BankOperationKind } from './bank-operation-kind';
 
-const ISO_MONTH_LENGTH = 7;
 export function moscowToday(now = new Date()): string {
   return new Intl.DateTimeFormat('en-CA', {
     timeZone: 'Europe/Moscow',
@@ -54,7 +53,7 @@ export function bankBalance(
 }
 
 export function bankSummary(
-  period: string | { from: string; to: string },
+  period: { from: string; to: string },
   operations: Array<{
     kind: string;
     date: string;
@@ -70,12 +69,7 @@ export function bankSummary(
   >();
   // ponytail: O(N) history fold; optimize only after measuring growing histories.
   for (const operation of operations) {
-    if (
-      typeof period === 'string'
-        ? operation.date.slice(0, ISO_MONTH_LENGTH) !== period
-        : operation.date < period.from || operation.date > period.to
-    )
-      continue;
+    if (operation.date < period.from || operation.date > period.to) continue;
     if (
       operation.kind !== BankOperationKind.Expense &&
       operation.kind !== BankOperationKind.Refund