feat: Stockbit login for the order book, live quotes and daily history

Opt-in, with the user's own Stockbit session from a pasted
credentialStorage cookie (or IDX_STOCKBIT_REFRESH_TOKEN):

- idx stockbit login/status/logout; session file 0600, tokens never shown
- rotating refresh under a cross-process lock; one refresh+retry on 401
- stocks orderbook: depth with lots and orders, OHLC, value, foreign flow
- --provider stockbit quotes from the session API when logged in
- --history-provider stockbit, and auto under the stockbit provider for
  5d-1y daily windows
- MCP get_orderbook and stockbit_status (17 tools)

Endpoints, units and recorded responses from fzn0x/idx (MIT).

ROADMAP.md

@@ -12,11 +12,12 @@ history lives in git.
 - `screen presets` / `screen run <PRESET>`: built-in screener presets
   (graduate `screen` out of `stocks` only if these grow into a richer workflow)
 - Multi-period financial statements (today `financials` is single-period)
-- Order book depth: no free, login-free source exists (IDX sells delayed depth
-  to vendors). Planned as the Stockbit login follow-on: opt-in with the
-  user's own account, the depth ladder, intraday OHLCV and token refresh from
-  `exodus.stockbit.com`; fzn0x/idx (MIT) maps the endpoints. The public page
-  already gives the best bid/offer (L1) while the market is open.
+- Order book depth without a login: no free source exists (IDX sells delayed
+  depth to vendors); `stocks orderbook` needs the user's Stockbit login.
+- Stockbit login follow-ups: a browser capture for `idx stockbit login`
+  (Chrome DevTools, as fzn0x/idx does) instead of pasting the cookie,
+  intraday OHLCV from the session's `1d` chart, and observing the session
+  API's open-market state name (assumed `STATE_NAME_MARKET_OPEN`).
 - Observe Stockbit's `market_hour.status` in the pre-open (08:45-09:00) and
   the closing auction (15:50-16:00) before `--watch` or alerts build on it;
   `open`, `break` and `close` are known, and the bid/offer gate hides the book