fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/modules/investments/portfolio/application/portfolio.service.ts

@@ -14,6 +14,7 @@ import {
 } from '@nestjs/common';
 import {
   add,
+  decimalFromString,
   formatDecimal,
   isZero,
   multiply,
@@ -511,12 +512,3 @@ export class PortfolioService {
       : null;
   }
 }
-
-function decimalFromString(value: string) {
-  const negative = value.startsWith('-');
-  const [whole, fraction = ''] = (negative ? value.slice(1) : value).split('.');
-  return {
-    value: (negative ? -1n : 1n) * BigInt(`${whole}${fraction}`),
-    scale: fraction.length,
-  };
-}