fix: preserve validated Schwab holdings currency provenance

[Pigbibi]

Summary

• Accept and preserve optional Schwab holding currency_source only when it is exactly owner_confirmed and currency is explicitly USD; do not infer currency or provenance.
• Keep exact-key rejection, legacy no-provenance rows, optional decimal avg_cost, IBKR behavior, producer pins and current publisher stripping unchanged.
• Upgrade the real pinned Schwab archive contract from the known 400 blocker to unchanged-payload authenticated sync → SQLite → API readback/daily-history coverage. Malformed provenance and unknown fields still fail without overwriting accepted evidence.

Boundary decision

The pinned Schwab producer explicitly labels USD as owner-confirmed after accepting runtime currency None/USD. Removing that field would discard meaningful provenance. This narrow receiver change preserves it without a producer migration or storage schema change. Provenance is retained in API/storage/history; this PR does not add a UI provenance column.

Validation

• Independent review: no blocking findings; reviewer separately passed account-facts, pinned-producer roundtrip and read-model/React metadata suites.
• Real exact-pin roundtrip and deterministic regeneration comparison passed. Neither source nor fixture pins changed.
• Full Validate JS commands passed using Node 22 (NODE_NO_WARNINGS=1 locally to avoid environment proxy warnings contaminating an existing empty-stderr assertion).
• Python: 543 tests, OK with 10 existing skips; runtime target/config validation passed.
• Frontend TypeScript/build, generated asset equality, Python sdist/wheel build, pip check, git diff --check passed.
• Remote CI must pass on this exact head before any later approved merge.

Rollout / safety

Draft only. No merge, deployment, publisher enablement, production account-data write, broker call or trade. Tests use synthetic data and offline receiver storage. Both publishers still strip holdings.

Merging QRS runtime changes to main triggers automatic deployment, so a later merge/release requires separate owner approval. Release compatible receiver first, verify deployed revision/read-only health and restricted normal-runtime report evidence second, and consider publisher enablement only under a separate approval. No production adoption evidence is established here. After provenance-bearing history is stored, downgrading to an exact-key receiver that rejects this field requires a separate compatibility/migration plan.

中文

仅修复 Schwab 持仓来源字段的接收兼容：显式 USD + owner_confirmed，来源保留在 API、存储及每日历史；不推断货币，不新增 UI 列。未知键、非法来源及 IBKR 规则保持严格，旧载荷可读，真实固定版本发布器输出无需改写即可通过跨端测试。继续剥离持仓；本 PR 保持草稿，不合并、不部署、不启用发送。后续合并会自动部署，须另行批准；合成测试不代表生产已采用。