fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/modules/investments/tbank-sync/tbank-sync.service.ts

@@ -9,6 +9,7 @@ import {
   TbankAccessService,
   TbankMembershipService,
   InstrumentMetadataService,
+  type TbankSyncAttempt,
 } from '../../../integrations/tbank/tbank.api';
 import { PortfolioService } from '../portfolio/portfolio.api';
 import {
@@ -30,7 +31,6 @@ import { IncomeAnalyticsService } from '../income/income-read.api';
 import { UpcomingEventsService } from '../upcoming-events/upcoming-events-read.api';
 import { planInvestmentScreen } from '../investment-sync-plan';
 import type { InvestmentResourceMetaDto } from '../investment-resource.dto';
-import type { TbankSyncAttempt } from '../../../integrations/tbank/tbank-access.service';
 import {
   TbankSyncRepository,
   type ScreenIntent,
@@ -303,6 +303,7 @@ export class TbankSyncService {
             },
             now,
             true,
+            0,
           ),
         ]);
       }
@@ -327,10 +328,17 @@ export class TbankSyncService {
       return this.sourceStatus(userId, saved.work);
     const intent = saved.work.intent as unknown as ScreenIntent;
     await this.access.local(userId, intent.scope.accountId);
-    const running = saved.children.some((child) => child.state === 'running');
+    const children = await Promise.all(
+      saved.children.map((child) =>
+        child.state === 'superseded'
+          ? this.operations.observe(userId, child.id)
+          : Promise.resolve(child),
+      ),
+    );
+    const running = children.some((child) => child.state === 'running');
     const failed =
       saved.work.errorCode ??
-      saved.children.find((child) => child.errorCode)?.errorCode ??
+      children.find((child) => child.errorCode)?.errorCode ??
       null;
     const state =
       saved.work.processRunId !== this.runId &&
@@ -340,7 +348,7 @@ export class TbankSyncService {
           ? 'running'
           : failed
             ? 'failed'
-            : saved.children.some((child) => child.state === 'cancelled')
+            : children.some((child) => child.state === 'cancelled')
               ? 'cancelled'
               : 'succeeded';
     const resources = await this.observe(userId, intent.scope);
@@ -355,9 +363,8 @@ export class TbankSyncService {
       state,
       errorCode: failed,
       progress: {
-        completed: saved.children.filter((child) => child.state !== 'running')
-          .length,
-        total: saved.children.length,
+        completed: children.filter((child) => child.state !== 'running').length,
+        total: children.length,
         discovering: !saved.progress.dispatched,
       },
       resources,