feat(mcp): trade and read tastytrade, Saxo Bank and Kalshi accounts

[chris-cpz]

Why

Chris: "Simons and mcp must see it too". CPZ-Lab/cpzai#1765 makes rest-api list, read and trade Saxo Bank, tastytrade and Kalshi accounts through the CPZ gateway. The MCP tools still could not use it:

• place_order's symbol rejects tastytrade futures and options. It must start with a letter or digit and cannot contain spaces, so /ESZ6, ./ESZ6 E1AZ6 261205P3720 and AAPL 261016C00200000 all failed validation.
• No idempotency key. There was no way to pass a client_order_id, so a timed-out order could not be reconciled.
• No sell-to-open confirmation. There was no way to pass position_effect, which tastytrade now requires to write an option.
• Budget too short. The 20 s default is shorter than a gateway order can take (up to 45 s at rest-api).

What

• orderSymbol (for place_order only): the old pattern, plus an optional leading / or ./ and internal spaces, max 48. Data tools keep the stricter symbol.
• place_order gains:
  • optional client_order_id (1 to 50 of [A-Za-z0-9._:-]);
  • optional position_effect (open | close);
  • a 60 s budget;
  • a description that names the gateway brokers and says to reconcile by client_order_id after a timeout.
• list_positions: a broker filter, and it says a broker that could not be read comes back in account_errors, never as an empty book.
• list_accounts: the broker filter text names the brokers it now covers.
• tool-catalog.json: regenerated (npm run export:catalog).

Verified

vitest: 234/234. New cases:

• the three tastytrade order symbols are accepted and forwarded (uppercased);
• client_order_id and position_effect are forwarded;
• a key over 50 characters, a key with a space, an unknown effect and a symbol with ; are all refused before any API call;
• the broker filter is forwarded on list_positions.

tsc --noEmit is clean.

Deploy

After CPZ-Lab/cpzai#1765 is deployed (rest-api + cpz). Until then the new fields are harmless: rest-api ignores them for other brokers.