feat: Stockbit login for the order book, live quotes and daily history

Opt-in, with the user's own Stockbit session from a pasted
credentialStorage cookie (or IDX_STOCKBIT_REFRESH_TOKEN):

- idx stockbit login/status/logout; session file 0600, tokens never shown
- rotating refresh under a cross-process lock; one refresh+retry on 401
- stocks orderbook: depth with lots and orders, OHLC, value, foreign flow
- --provider stockbit quotes from the session API when logged in
- --history-provider stockbit, and auto under the stockbit provider for
  5d-1y daily windows
- MCP get_orderbook and stockbit_status (17 tools)

Endpoints, units and recorded responses from fzn0x/idx (MIT).

docs/SMOKE.md

@@ -60,7 +60,12 @@ scripts/live-smoke.sh --dry-run
   whose MSN key ratios contain non-finite values.
 - `stockbit`: `intraday` for the ticker and `^JKSE`, and
   `--provider stockbit stocks quote`, on the new binary only. A run outside the
-  session sees `market_status: close` and no bid/offer.
+  session sees `market_status: close` and no bid/offer. These run without a
+  Stockbit login: each side has its own config, and seeding it with a real
+  refresh token would rotate (and so retire) that token. Check the login
+  features by hand with your own session: `idx stockbit status`,
+  `idx stocks orderbook BBCA`, `idx --provider stockbit stocks quote BBCA` and
+  `idx --provider stockbit stocks history BBCA --period 1y`.
 - `ownership`: `discover`, then imports the newest supported report into a temp
   DB and lists `releases`. IDX sits behind Cloudflare and returns `403` to many
   datacenter IPs, including GitHub-hosted runners; run it from a network IDX accepts.