fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

test/tbank-metadata-persistence.e2e-spec.ts

@@ -25,7 +25,7 @@ describe('durable shared instrument metadata (SQLite)', () => {
     getInstrumentByUid: jest.fn(),
     getInstrumentByFigi: jest.fn(),
   };
-  const access = new TbankAccessService(prisma, tokens, upstream as never);
+  const access = new TbankAccessService(prisma, tokens);
   const repository = new InstrumentMetadataRepository(prisma);
   const logger = { event: jest.fn() };
   const createService = () =>