feat!: persist T-Bank data and synchronize reads

Store account membership, portfolio, operations, forecasts and market sources in SQLite.
Coalesce scoped refreshes, fence connection revisions, preserve complete financial
snapshots and stabilize operation period state.

BREAKING CHANGE: investment reads return data/meta resource envelopes and locally
persisted snapshots; consumers must use the matching OpenAPI contract and explicit
synchronization endpoints.

test/all-accounts.e2e-spec.ts

@@ -1,15 +1,18 @@
-import { ConflictException, INestApplication } from '@nestjs/common';
+import { INestApplication } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import { Test } from '@nestjs/testing';
 import type { Server } from 'node:http';
 import request from 'supertest';
 import { AppModule } from '../src/app.module';
-import { TbankAccessService } from '../src/integrations/tbank/tbank-access.service';
+import { PrismaService } from '../src/prisma/prisma.service';
+import { TbankClient } from '../src/integrations/tbank/tbank.client';
+import { TbankTokenService } from '../src/integrations/tbank/tbank-token.service';
 import { configureApp } from '../src/main';
 
 describe('All accounts HTTP boundary', () => {
   let app: INestApplication<Server>;
-  const withSupportedAccounts = jest.fn();
+  let prisma: PrismaService;
+  const upstream = { getOpenAccounts: jest.fn() };
   const token = new JwtService().sign(
     { sub: 'account-owner', type: 'access' },
     { secret: process.env.JWT_SECRET },
@@ -24,45 +27,66 @@ describe('All accounts HTTP boundary', () => {
 
   beforeAll(async () => {
     const module = await Test.createTestingModule({ imports: [AppModule] })
-      .overrideProvider(TbankAccessService)
-      .useValue({ withSupportedAccounts })
+      .overrideProvider(TbankClient)
+      .useValue(upstream)
       .compile();
     app = module.createNestApplication();
     configureApp(app);
     await app.init();
+    await app.listen(0, '127.0.0.1');
+    prisma = app.get(PrismaService);
+    await prisma.user.create({
+      data: {
+        id: 'account-owner',
+        email: 'all@example.invalid',
+        passwordHash: 'synthetic',
+      },
+    });
   });
-  beforeEach(() => {
-    withSupportedAccounts.mockReset();
-    withSupportedAccounts.mockImplementation(
-      (_user: string, handler: (context: unknown) => unknown) =>
-        handler({ token: 'unused', generation: 'first', accounts: [] }),
-    );
+  beforeEach(async () => {
+    upstream.getOpenAccounts.mockReset().mockResolvedValue([]);
+    await prisma.tbankConnection.deleteMany();
+    await prisma.tbankConnection.create({
+      data: {
+        userId: 'account-owner',
+        encryptedToken: app.get(TbankTokenService).encrypt('synthetic'),
+        connectedAt: new Date(),
+        membershipAt: new Date(),
+        membershipRevision: 1,
+      },
+    });
   });
   afterAll(() => app.close());
 
   it.each(paths)('requires authentication for /all/%s', async (path) => {
     await request(app.getHttpServer())
-      .get(`/api/v1/brokerage-accounts/all/${path}`)
+      .get(
+        `/api/v1/brokerage-accounts/all/${path}${path.includes('?') ? '&' : '?'}sync=observe`,
+      )
       .expect(401);
-    expect(withSupportedAccounts).not.toHaveBeenCalled();
+    expect(upstream.getOpenAccounts).not.toHaveBeenCalled();
   });
 
   it.each(paths)(
     'routes /all/%s to the aggregate with verified identity',
     async (path) => {
       const response = await request(app.getHttpServer())
-        .get(`/api/v1/brokerage-accounts/all/${path}`)
+        .get(
+          `/api/v1/brokerage-accounts/all/${path}${path.includes('?') ? '&' : '?'}sync=observe`,
+        )
         .set('Authorization', `Bearer ${token}`)
         .expect(200);
-      expect(withSupportedAccounts).toHaveBeenCalledWith(
-        'account-owner',
-        expect.any(Function),
-      );
       expect(response.body).not.toHaveProperty('token');
       expect(response.body).not.toHaveProperty('generation');
       if (path === 'portfolio')
-        expect(response.body).toMatchObject({ positions: [] });
-      else expect(response.body).toMatchObject({ accountId: 'all' });
+        expect(response.body).toMatchObject({
+          data: { positions: [] },
+          meta: { availability: 'complete' },
+        });
+      else
+        expect(response.body).toMatchObject({
+          meta: { availability: 'complete' },
+        });
     },
   );
 
@@ -75,7 +99,9 @@ describe('All accounts HTTP boundary', () => {
     'income-analytics?from=2026-08-31&to=2026-08-01',
   ])('validates /all/%s in the configured pipeline', async (path) => {
     await request(app.getHttpServer())
-      .get(`/api/v1/brokerage-accounts/all/${path}`)
+      .get(
+        `/api/v1/brokerage-accounts/all/${path}${path.includes('?') ? '&' : '?'}sync=observe`,
+      )
       .set('Authorization', `Bearer ${token}`)
       .expect(400);
   });
@@ -89,9 +115,7 @@ describe('All accounts HTTP boundary', () => {
   });
 
   it('preserves connection errors without a partial success response', async () => {
-    withSupportedAccounts.mockRejectedValue(
-      new ConflictException({ code: 'TBANK_NOT_CONNECTED' }),
-    );
+    await prisma.tbankConnection.deleteMany();
     const response = await request(app.getHttpServer())
       .get('/api/v1/brokerage-accounts/all/portfolio')
       .set('Authorization', `Bearer ${token}`)