feat: import Futu OpenAPI (moomoo) integration from upstream PR #203

[alvinchow97]

Summary

• Pulls in OpenByteInc/QuantDinger#203 ("Add Futu OpenAPI integration for HK and US trading"), an open, unmerged upstream PR by @dl-sdu, into this fork
• This supersedes an earlier lightweight moomoo scaffold I was building independently — Add Futu OpenAPI integration for HK and US trading OpenByteInc/QuantDinger#203 is a full production implementation (market data, live/simulated trading, credential vault integration, strategy execution wiring, execution-stream reconciliation, a Docker/WSL OpenD bridge, and 12 new test files) rather than a standalone quick-trade-only stub
• moomoo and Futu share the same OpenD gateway and futu-api SDK — this is the same underlying broker integration the earlier scaffold was targeting

What's included

Merged via git merge (preserving upstream authorship) of the 4 commits from dl-sdu/QuantDinger:feat/futu-openapi:

• app/data_sources/futu.py — market-data adapter
• app/services/futu_trading/ — client, config, symbol mapping, quote client/feed, session pooling, timezones
• app/routes/futu.py — API routes
• Credential vault integration (app/routes/credentials.py)
• Strategy execution wiring (trading_executor.py, pending_order_worker.py, strategy_v2/)
• Execution-stream hardening against duplicate fills, reconnect races, missed ledger projections
• scripts/opend_relay.py — secure WSL/Docker bridge to a host-run OpenD gateway
• docs/architecture/FUTU_OPEND.md
• 12 new/updated test files

Fix on top of the merge

The merge combined two independent changes to pending_order_worker.py — this fork's main had already modified it (fix: normalize live order and template precision) on top of the same base commit OpenByteInc#203 branched from. The additive merge pushed the file 23 lines past the line-count baseline OpenByteInc#203's branch had bumped it to. Resynced scripts/backend_quality_baseline.json to the true post-merge line count.

Test plan

• git diff reviewed for merge conflict markers — none found, clean auto-merge
• Verified requirements.txt/requirements.lock diff before installing anything — confirmed only one new dependency (futu-api, the official Futu/moomoo SDK) was introduced; this fork's CVE-patched floors (cryptography, pypdf, aiohttp, ccxt) were preserved by git's 3-way merge, not overwritten by the older pins on the source branch
• Rebuilt the backend Docker image from the merged branch — built cleanly
• Ran the full non-integration/non-stress suite inside the built image: 1480 passed, 6 deselected (0 failures after the baseline fix)
• Ran the Futu-specific test files directly: 55 passed, 1 skipped
• Verify against a live OpenD instance (paper trading) — not yet done in this fork; upstream's PR description claims a completed HK simulated round-trip with ledger reconciliation