refactor!: simplify runtime coordination #7

Keep financial ownership, atomic publication and refresh CAS.
Failed refresh leaves cookies untouched; logout still clears them.

Remove full-history candle prefetch and special metadata retries.
Use native Pino request context instead of parallel middleware.

BREAKING CHANGE: remove investment stateVersion, queued sync state,
and tbank-sync status progress/resources. Consumers must observe
resources through sync=observe with the updated frontend contract.

src/modules/auth/presentation/auth.controller.ts

@@ -85,14 +85,9 @@ export class AuthController {
     @Req() request: Request,
     @Res({ passthrough: true }) response: Response,
   ) {
-    try {
-      const token = this.refreshToken(request);
-      if (!token) throw new UnauthorizedException({ code: HttpErrorCode.Unauthorized });
-      return this.respond(response, await this.auth.refresh(token));
-    } catch (error) {
-      if (error instanceof UnauthorizedException) this.clearCookie(response);
-      throw error;
-    }
+    const token = this.refreshToken(request);
+    if (!token) throw new UnauthorizedException({ code: HttpErrorCode.Unauthorized });
+    return this.respond(response, await this.auth.refresh(token));
   }
 
   @Post('logout')

src/modules/auth/presentation/jwt-auth.guard.ts

@@ -1,12 +1,12 @@
 import { ExecutionContext, Injectable } from '@nestjs/common';
 import { AuthGuard } from '@nestjs/passport';
+import { PinoLogger } from 'nestjs-pino';
 
-import { RequestContextService } from '../../../common/logging/request-context.service';
 import { AccessPayload } from '../application/auth.types';
 
 @Injectable()
 export class JwtAuthGuard extends AuthGuard('jwt') {
-  constructor(private readonly requestContext: RequestContextService) {
+  constructor(private readonly logger: PinoLogger) {
     super();
   }
 
@@ -16,7 +16,7 @@ export class JwtAuthGuard extends AuthGuard('jwt') {
       .switchToHttp()
       .getRequest<{ user?: AccessPayload }>();
     if (request.user?.sub) {
-      this.requestContext.set({ userId: request.user.sub });
+      this.logger.assign({ userId: request.user.sub });
     }
     return Boolean(allowed);
   }