feat: foreign flow (idx stocks flow, get_foreign_flow)

`idx stocks flow SYMBOL` shows what foreign investors bought and sold of a
stock, session by session, from IDX's own daily trading summary: foreign
buy, sell and net volume, net value at the session's average price, and
the share of value traded outside the regular board, with range totals.
Latest 10 sessions by default (--days, at most 60) or --from/--to. The MCP
server exposes it as get_foreign_flow.

- api/idx: pure parser for GetStockSummary (rows dated another session
  are dropped) and a provider over curl-impersonate's profile fallback
  with a 30 s limit; Cloudflare passes only some fingerprints.
- flow: each session is cached whole by date, so other stocks' flows for
  the same sessions need no request. Weekends are never requested.
- Idx::idx_code is shared by broker and flow for the .JK-only check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

ROADMAP.md

@@ -11,6 +11,13 @@ history lives in git.
 - `screen presets` / `screen run <PRESET>`: built-in screener presets
   (graduate `screen` out of `stocks` only if these grow into a richer workflow)
 - Multi-period financial statements (today `financials` is single-period)
+- Order book (bid/offer depth): no free, login-free source exists. IDX sells
+  delayed depth to vendors and Stockbit's needs a user login. Revisit if a
+  permitted source appears; do not ship the closing best bid/offer as one.
+- Bandarmology follow-ups: a daily series (per-session readings and the
+  cumulative top-N net) and a price-move phase (quiet accumulation, markup),
+  calibration of the `top_concentration_v1` thresholds across more sessions,
+  and a market-wide foreign flow screen from one IDX trading summary
 - News beyond MSN in `news` / `get_company` (`docs/IDX_NEWS.md`): Google News
   RSS per ticker, and IDX disclosures and exchange news through a
   maintainer-published feed
@@ -26,6 +33,11 @@ history lives in git.
 - Composite `analyze` command (quote, fundamentals, ownership, sentiment)
 
 ## Known limits
+- `stocks broker` and `stocks bandar` show only IPOT's top 10 buyers and
+  sellers, ranked by gross lots, with figures of a million and more rounded
+  to one decimal.
+- `stocks flow` depends on IDX's Cloudflare passing a curl-impersonate
+  profile (only `curl_safari184` in October 2026).
 - Yahoo can return `429` from datacenter IPs; requests retry with backoff but
   can still fail.
 - `stocks technical` reports the SMA200 trend as unavailable when fewer than