feat: foreign flow (idx stocks flow, get_foreign_flow)

`idx stocks flow SYMBOL` shows what foreign investors bought and sold of a
stock, session by session, from IDX's own daily trading summary: foreign
buy, sell and net volume, net value at the session's average price, and
the share of value traded outside the regular board, with range totals.
Latest 10 sessions by default (--days, at most 60) or --from/--to. The MCP
server exposes it as get_foreign_flow.

- api/idx: pure parser for GetStockSummary (rows dated another session
  are dropped) and a provider over curl-impersonate's profile fallback
  with a 30 s limit; Cloudflare passes only some fingerprints.
- flow: each session is cached whole by date, so other stocks' flows for
  the same sessions need no request. Weekends are never requested.
- Idx::idx_code is shared by broker and flow for the .JK-only check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

docs/ARCHITECTURE.md

@@ -53,6 +53,8 @@ command parses arguments, makes one idx-core call, and renders the result.
 - **Yahoo Finance** — default/auto history source. Reliable OHLCV data via `/v8/finance/chart/`.
 - **IPOT (Indo Premier)** — broker summaries, whichever provider is selected
   (`BrokerSummaryProvider`). See [Broker Summaries](#broker-summaries).
+- **IDX (idx.co.id)** — the daily trading summary behind foreign flow
+  (`TradingSummaryProvider`). See [Foreign Flow](#foreign-flow).
 
 ### MSN Endpoints
 - `https://assets.msn.com/service/`: quotes, charts, equities, earnings,
@@ -109,6 +111,22 @@ WIB as the fallback.
   fzn0x/idx. A tier with a missing figure has no reading; missing values are
   never summed as zero. A change to the rules gets a new method name.
 
+### Foreign Flow
+- `GET https://www.idx.co.id/primary/TradingSummary/GetStockSummary`
+  `?length=9999&start=0&date=YYYYMMDD` answers one JSON row per stock for the
+  session: prices, volume, value, `ForeignBuy`/`ForeignSell` (shares) and
+  non-regular volume and value. A day without trading has no rows; rows dated
+  another day are dropped. `api/idx/parse.rs` parses it purely.
+- Cloudflare rejects most TLS fingerprints (in October 2026 only
+  `curl_safari184` passed), so the request uses curl-impersonate's profile
+  fallback with a 30 s limit. A challenge page fails that profile, not the
+  parse.
+- Each session is cached whole (every stock) by date: 30 days once past,
+  5 minutes for today. `Flow::foreign` walks weekdays without requesting
+  weekends; offline, `--days` skips uncached sessions while a `--from/--to`
+  range fails on one. `foreign_net_value` is net shares at the session's
+  average price (value over volume), an estimate.
+
 ### Capability Gating
 ```
 MarketDataProvider = QuoteProvider + FundamentalsProvider
@@ -118,6 +136,7 @@ Factory functions:
   default_provider(kind) → Box<dyn MarketDataProvider>
   history_provider(kind, mode, verbose) → Result<(ProviderKind, Box<dyn HistoryProvider>)>
   broker_provider() → Box<dyn BrokerSummaryProvider>
+  trading_summary_provider() → Box<dyn TradingSummaryProvider>
 ```
 
 ## Ownership Module (SQLite-backed)