fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

test/openapi-contract.e2e-spec.ts

@@ -127,6 +127,23 @@ describe('OpenAPI contract (integration)', () => {
   });
 
   it('generates the runtime contract without server startup or deployment configuration', async () => {
+    expect(
+      createOpenApiDocument(app).components?.schemas?.ProblemDetailsDto,
+    ).toMatchObject({
+      properties: {
+        errors: {
+          type: 'array',
+          items: {
+            type: 'object',
+            required: ['pointer', 'detail'],
+            properties: {
+              pointer: { type: 'string' },
+              detail: { type: 'string' },
+            },
+          },
+        },
+      },
+    });
     const directory = await mkdtemp(resolve(tmpdir(), 'wealthledger-openapi-'));
     try {
       const networkGuard = resolve(directory, 'no-network.cjs');