feat: login-free Stockbit intraday and quote provider

Read Stockbit's public symbol page (__NEXT_DATA__) with a plain ureq
request and an honest user agent: `stocks intraday` (today by the
minute, any provider), `--provider stockbit` quotes with the best
bid/offer only while the market is open, and MCP `get_intraday`.

- UPSTREAMBLOCKED error (exit 4) for a CDN 403; never retried
- requests paced 1 s apart across idx processes, 5 s snapshot cache
- global --provider flag (yahoo, msn, stockbit)
- roadmap: L1 ships from Stockbit; depth stays a login follow-on

ROADMAP.md

@@ -4,16 +4,23 @@ Open work only. Shipped behavior is described in `README.md` and `docs/`;
 history lives in git.
 
 ## Stocks
-- `market summary`: IHSG index and market breadth
+- `market summary`: market breadth and an index overview (index levels alone
+  are already `stocks intraday ^JKSE` and `--provider stockbit stocks quote IHSG`)
 - `market movers`: top gainers, losers, and volume
 - `market sectors`: sector performance overview
 - `screen query "<EXPR>"`: filter stocks by expression
 - `screen presets` / `screen run <PRESET>`: built-in screener presets
   (graduate `screen` out of `stocks` only if these grow into a richer workflow)
 - Multi-period financial statements (today `financials` is single-period)
-- Order book (bid/offer depth): no free, login-free source exists. IDX sells
-  delayed depth to vendors and Stockbit's needs a user login. Revisit if a
-  permitted source appears; do not ship the closing best bid/offer as one.
+- Order book depth: no free, login-free source exists (IDX sells delayed depth
+  to vendors). Planned as the Stockbit login follow-on: opt-in with the
+  user's own account, the depth ladder, intraday OHLCV and token refresh from
+  `exodus.stockbit.com`; fzn0x/idx (MIT) maps the endpoints. The public page
+  already gives the best bid/offer (L1) while the market is open.
+- Observe Stockbit's `market_hour.status` in the pre-open (08:45-09:00) and
+  the closing auction (15:50-16:00) before `--watch` or alerts build on it;
+  `open`, `break` and `close` are known, and the bid/offer gate hides the book
+  for anything but `open`.
 - Bandarmology follow-ups: a daily series (per-session readings and the
   cumulative top-N net) and a price-move phase (quiet accumulation, markup),
   calibration of the `top_concentration_v1` thresholds across more sessions,
@@ -26,7 +33,8 @@ history lives in git.
 - `watchlist`: named symbol sets usable by other commands
 - `alerts`: price alerts with a daemon
 - CSV/TSV output
-- Additional providers (Alpha Vantage, Twelve Data, IDX official)
+- Additional providers (Alpha Vantage, Twelve Data); IDX's own site serves
+  only `stocks flow --source idx` today
 
 ## Agent integration
 - JSON Schema export for command output
@@ -39,11 +47,16 @@ history lives in git.
 - `stocks flow --source idx` depends on IDX's Cloudflare passing a
   curl-impersonate profile (only `curl_safari184` in October 2026) and on the
   network; the default IPOT source rounds to one decimal.
+- Stockbit's terms call its data delayed at least 10 minutes and for
+  personal, non-commercial use (on 2026-10-23 the last trade was within a
+  minute of the clock); its CDN refuses some user agents with a 403
+  (`UPSTREAMBLOCKED`). Its order-book sizes are not shown: the page does not
+  say whether they are lots or shares.
 - Yahoo can return `429` from datacenter IPs; requests retry with backoff but
   can still fail.
 - `stocks technical` reports the SMA200 trend as unavailable when fewer than
   200 daily candles are returned.
-- MSN's `low-pe` screen returned no priced stocks on 2026-10-14 (upstream;
-  other filters work).
+- MSN's `low-pe` screen returns no priced stocks (`PARSEERROR`; still so on
+  2026-10-23, upstream; other filters work).
 - MSN history for IDX is price-only (`1mo`, `3mo`, `1y`); Yahoo stays the
   default OHLCV source.