feat: foreign flow from IPOT by default (--source ipot|idx)

`idx stocks flow` now reads IPOT by default, which needs nothing installed:
per session, the all-investor broker summary gives the value traded and
the foreign one gives foreign buying (its footer), the foreign net and
selling (buying less the net), across all boards, through the broker
summary cache. IPOT's foreign net matched IDX's estimate within 0.3 B on
BBCA 2026-10-12 to 16.

`--source idx` (and `source` on get_foreign_flow) keeps IDX's trading
summary: exact share counts, close and the non-regular share, behind
curl-impersonate and Cloudflare.

- ForeignFlowDay gains foreign_buy_value, foreign_sell_value and
  foreign_share_bps for both sources (estimated at the session average
  for IDX); ForeignFlow gains source, the value totals and rounded.
- The table lays out each source's figures; the live smoke runs both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

ROADMAP.md

@@ -36,8 +36,9 @@ history lives in git.
 - `stocks broker` and `stocks bandar` show only IPOT's top 10 buyers and
   sellers, ranked by gross lots, with figures of a million and more rounded
   to one decimal.
-- `stocks flow` depends on IDX's Cloudflare passing a curl-impersonate
-  profile (only `curl_safari184` in October 2026).
+- `stocks flow --source idx` depends on IDX's Cloudflare passing a
+  curl-impersonate profile (only `curl_safari184` in October 2026) and on the
+  network; the default IPOT source rounds to one decimal.
 - Yahoo can return `429` from datacenter IPs; requests retry with backoff but
   can still fail.
 - `stocks technical` reports the SMA200 trend as unavailable when fewer than