feat: Stockbit login for the order book, live quotes and daily history

Opt-in, with the user's own Stockbit session from a pasted
credentialStorage cookie (or IDX_STOCKBIT_REFRESH_TOKEN):

- idx stockbit login/status/logout; session file 0600, tokens never shown
- rotating refresh under a cross-process lock; one refresh+retry on 401
- stocks orderbook: depth with lots and orders, OHLC, value, foreign flow
- --provider stockbit quotes from the session API when logged in
- --history-provider stockbit, and auto under the stockbit provider for
  5d-1y daily windows
- MCP get_orderbook and stockbit_status (17 tools)

Endpoints, units and recorded responses from fzn0x/idx (MIT).

web/src/content/docs/cli/stockbit.md

@@ -1,12 +1,13 @@
 ---
 title: Stockbit
-description: Today's session by the minute and quotes with best bid/offer, from Stockbit's public page. Opt-in, no account.
+description: Today's session by the minute and quotes with best bid/offer from Stockbit's public page, plus the order book and live quotes with your own Stockbit login. Both opt-in.
 ---
 
 [Stockbit](https://stockbit.com)'s public symbol page carries a quote, the
 best bid and offer, and today's price for every minute of the session. idx
 reads that page directly. It needs no Stockbit account, no login and no
-helper tools.
+helper tools. With your own Stockbit account, idx can also read the order
+book and live quotes; see [With your Stockbit login](#with-your-stockbit-login).
 
 ```bash
 idx stocks intraday BBCA                     # today's session, by the minute
@@ -31,7 +32,7 @@ idx -o json stocks intraday BBCA | jq '.points | length'
   shows the book as it closed. idx leaves `bid` and `offer` out then, so the
   closing book never passes for a live one.
 - **Top of the book only.** One bid and one offer price, no depth. The full
-  order book needs a Stockbit login, which idx does not do.
+  order book needs your [Stockbit login](#with-your-stockbit-login).
 - **Prices only.** The page has no per-minute volume or OHLC.
 - **Empty sessions are data.** A suspended or delisted stock answers with
   `points: []` and a `session_note` saying so (`Stockbit lists the stock as
@@ -41,8 +42,9 @@ idx -o json stocks intraday BBCA | jq '.points | length'
 
 `--provider stockbit` (or `IDX_PROVIDER=stockbit`, or
 `idx config set general.provider stockbit`) changes only where quotes come
-from. History still comes from Yahoo. Company data, fundamentals and
-screening answer `UNSUPPORTED` under it, so use MSN for those.
+from. Without a login, history still comes from Yahoo. Company data,
+fundamentals and screening answer `UNSUPPORTED` under it, so use MSN for
+those.
 
 ## How idx talks to Stockbit
 
@@ -63,13 +65,63 @@ screening answer `UNSUPPORTED` under it, so use MSN for those.
   Wait, or try from another network. `--provider msn` serves quotes without
   Stockbit.
 
+## With your Stockbit login
+
+Opt-in, and only with your own account. idx then talks to Stockbit's own API
+(`exodus.stockbit.com`) with your session's tokens.
+
+```bash
+idx stockbit login                    # paste the credentialStorage cookie
+idx stockbit status                   # logged in? when do the tokens expire?
+idx stocks orderbook BBCA             # depth, queued orders, foreign flow
+idx stocks orderbook BBRI --depth 5
+idx --provider stockbit stocks quote BBCA                    # live, not delayed
+idx --provider stockbit stocks history BBCA --period 1y      # Stockbit's daily candles
+idx stockbit logout
+```
+
+**Logging in.** In a browser logged in to stockbit.com, open DevTools,
+Application, Cookies, `https://stockbit.com`, and copy the value of
+`credentialStorage`. Paste it into `idx stockbit login`, or pipe it
+(`pbpaste | idx stockbit login`). A refresh token on its own works too. idx
+checks the session with one request and stores it in
+`~/.config/idx/stockbit-session.json`, readable only by you. Tokens never
+appear in output, logs or errors. On a server, set
+`IDX_STOCKBIT_REFRESH_TOKEN` instead.
+
+**One refresher per session.** Stockbit replaces the refresh token every time
+it is used. Once idx refreshes your session, a browser holding the same
+session has to log in again, and two tools sharing one session log each
+other out. Log in through a separate browser profile (or a private window
+you then close) for idx. idx processes on one machine take turns through a
+lock, so they never spend the token twice.
+
+What the login adds:
+
+| | Without a login | With your login |
+| --- | --- | --- |
+| `--provider stockbit` quotes | public page, delayed | Stockbit's API, live |
+| Bid and offer in quotes | best price, while open | best price, while open |
+| `stocks orderbook` | `AUTHERROR` | every level with lots and queued orders, OHLC, value, trades, foreign buy/sell/net |
+| `stocks history` under `--provider stockbit` | Yahoo | Stockbit's daily candles for `5d` to `1y`; Yahoo for other windows |
+| `stocks intraday` | public page | public page |
+
+The order book is what Stockbit's own app shows. Outside trading it is the
+book as the market left it, and the output says so. Sizes are lots in the
+table and shares in JSON. `--history-provider stockbit` asks for Stockbit's
+candles explicitly; windows it charts only weekly or hourly (`2y`, `5y`,
+`1wk`) answer `UNSUPPORTED`.
+
 ## Terms
 
 Stockbit's [terms](https://stockbit.com/terms) allow its content for personal,
 non-commercial use. They prohibit data mining, robots and redistribution
 without Stockbit's written consent. idx is not affiliated with or endorsed by
 Stockbit. Use this for looking at a stock now and then, not for crawling the
-market or republishing prices.
+market or republishing prices. With your login, automated use is tied to your
+account: keep it human-paced.
 
-Over MCP, the same data comes from the `get_intraday` tool, and from
-`get_quotes` when the server runs with `IDX_PROVIDER=stockbit`.
+Over MCP, the same data comes from `get_intraday`, `get_orderbook` and
+`stockbit_status`, and from `get_quotes` and `get_price_history` when the
+server runs with `IDX_PROVIDER=stockbit`. The server never logs in; run
+`idx stockbit login` in a terminal.