feat(console): read-only holdings panel from broker_reported_positions

[Pigbibi]

Draft for owner review. Do not merge or deploy without separate owner approval. Release order is receiver first (publishers still strip holdings), then verified runtime report evidence, then separately approved publisher enablement. Publisher enablement is NOT a prerequisite for releasing the compatible receiver.

Receiver (account_facts.js)

• /api/account-facts/sync history accepts optional broker_reported_positions + broker_reported_positions_scope, as a pair. Scope is fixed per platform: IBKR stocks_only, Schwab strategy_symbols_only; other platforms reject it.
• Rows are exact-key (symbol, quantity, market_value, currency, optional avg_cost), decimal strings, unique uppercase symbols, 1–64 rows. Anything malformed rejects the write (invalid_account_facts_positions); an empty list is never stored.
• Read model exposes positions / positions_scope only while the snapshot is fresh. Older history without positions stays readable.

Frontend

• A 持仓 panel for a selected non-Binance account. Shows symbol / quantity / market value plus the scope note. Missing, stale, unscoped, or malformed positions show 暂无持仓数据, never zero rows.

Follow-ups (separate PRs)

• IBKR publish_account_facts_from_report.py and Schwab publish_account_facts_from_reports.py currently strip ARCHIVE_ONLY_KEYS before publish. Stop stripping only after this receiver is live.

Merging auto-deploys the live console (deploy-strategy-switch-console.yml on push to main for web/strategy-switch-console/**). Owner approval is required. This PR will also need a rebase on whichever console PR lands first, because v2_asset_map.js is regenerated.

Release / rollback runbook

• Bilingual staged rollout and rollback.
• Holdings remain in latest and daily history (up to 366 observation days). UI staleness does not erase them. A pre-holdings receiver downgrade can reject persisted extended payloads; restore publisher stripping first and retain a compatible receiver unless a separate migration/compatibility plan is approved.

Additional verification

• Frontend typecheck/build and repository asset-generation script completed; generated v2_asset_map.js matches the existing committed file exactly.
• Receiver tests cover old/new payloads, scope/malformed rows/64-row boundary, durable readback/idempotency, rejected-write preservation, newer position-less snapshots and retained previous-day holdings.
• Account history presentation, operations, i18n, Worker, readonly/sync extraction and presentation validation passed locally.
• Runtime/config validation passed; Python suite: 526 tests, 10 skipped. Local Node 24; CI uses Node 22. CI for the final head must pass separately.
• These are synthetic/local checks, not production adoption evidence. No runtime, publisher or live account changes in this update.