fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/modules/investments/portfolio/application/forecast.service.ts

@@ -1,4 +1,5 @@
 import { Injectable } from '@nestjs/common';
+import { tbankSourceNeedsRefresh } from '../../../../integrations/tbank/tbank.api';
 import { investmentResourceMeta } from '../../investment-resource.mapper';
 import type { InvestmentResourceMetaDto } from '../../investment-resource.dto';
 import {
@@ -67,8 +68,23 @@ export class ForecastService {
       dependencies
         .map((dependency) => dependency.sync)
         .find((sync) => sync.state === 'failed');
+    const payload = stored ? (stored.payload as T) : null;
+    const data =
+      payload &&
+      'positionIsStale' in payload &&
+      'positionAt' in payload &&
+      typeof payload.positionAt === 'string'
+        ? {
+            ...payload,
+            positionIsStale: tbankSourceNeedsRefresh(
+              'portfolio',
+              new Date(payload.positionAt),
+              new Date(Date.now()),
+            ),
+          }
+        : payload;
     return {
-      data: stored ? (stored.payload as T) : null,
+      data,
       meta: investmentResourceMeta({
         resourceKey: input.scopeKey,
         dataRevision: String(stored?.dataRevision ?? 0),
@@ -80,7 +96,10 @@ export class ForecastService {
             ? 'partial'
             : 'missing',
         fetchedAt: first ? new Date(first) : null,
-        freshForMs: Number.POSITIVE_INFINITY,
+        freshForMs:
+          data && 'positionIsStale' in data && data.positionIsStale === true
+            ? 0
+            : Number.POSITIVE_INFINITY,
         work: work?.id ? { ...work, id: work.id } : null,
         dependencies,
       }),

src/modules/investments/portfolio/application/portfolio.service.ts

@@ -14,6 +14,7 @@ import {
 } from '@nestjs/common';
 import {
   add,
+  decimalFromString,
   formatDecimal,
   isZero,
   multiply,
@@ -511,12 +512,3 @@ export class PortfolioService {
       : null;
   }
 }
-
-function decimalFromString(value: string) {
-  const negative = value.startsWith('-');
-  const [whole, fraction = ''] = (negative ? value.slice(1) : value).split('.');
-  return {
-    value: (negative ? -1n : 1n) * BigInt(`${whole}${fraction}`),
-    scale: fraction.length,
-  };
-}