fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/modules/investments/tbank-sync/tbank-sync.controller.ts

@@ -10,7 +10,6 @@ import {
   Req,
   UseGuards,
   ValidationPipe,
-  type ValidationError,
 } from '@nestjs/common';
 import {
   ApiAcceptedResponse,
@@ -58,8 +57,8 @@ export class TbankSyncController {
         transform: true,
         whitelist: true,
         forbidNonWhitelisted: true,
-        exceptionFactory: (message) =>
-          new BadRequestException({ message: descriptorErrors(message) }),
+        validationError: { target: false, value: false },
+        exceptionFactory: (message) => new BadRequestException({ message }),
       }),
     )
     input: unknown,
@@ -75,13 +74,3 @@ export class TbankSyncController {
     return this.sync.status(request.user.sub, id);
   }
 }
-
-function descriptorErrors(
-  errors: ValidationError[],
-  prefix = '',
-): ValidationError[] {
-  return errors.flatMap((error) => [
-    { ...error, property: `${prefix}${error.property}` },
-    ...descriptorErrors(error.children ?? [], `${prefix}${error.property}/`),
-  ]);
-}