feat(market-data): add Moscow Exchange (MOEX ISS) provider - #1800

Description

Adds a Moscow Exchange (MOEX) market data provider backed by the public
ISS API (no API key).

Problem

Yahoo no longer serves MOEX listings, and no other built-in provider covers
them. Worse, a bare MOEX ticker resolves to whatever other venue shares it, so
Russian shares get valued with a foreign security's prices. Real cases from one
broker import:

What this adds

• MoexProvider (crates/market-data/src/provider/moex/), equities only,
  coverage restricted to MIC MISX (strict: rejects mic = None).
  • Latest: last trade → current official price → previous close
    (stamped with its own date before the first trade of the day).
  • History: lists the security's boards, pages each main T+ board
    (TQBR, TQTF, TQIF, currency ETF/fund boards) 100 rows at a time and
    merges one bar per trading date. This follows board moves (e.g. TMOS
    moved TQTF → TQBR in 2026), skips odd-lot (SMAL) and settlement
    (SPEQ) boards, prefers the board in the hinted currency, and falls back
    to LEGALCLOSEPRICE on days without trades. Delisted securities keep
    their history (e.g. MAIL, YNDX).
  • Search (traded main-board listings only) and profile (name, ISIN, type).
  • Numbers are parsed from the JSON literal (no f64 round trip); SUR → RUB;
    SECIDs are validated before they reach the URL path.
• MISX (Moscow Exchange, RUB, Europe/Moscow) in exchanges.json, plus
  RUB → MISX currency priority. No Yahoo suffix: Yahoo has no MOEX data, so
  a Yahoo lookup for MISX stays an untrusted fallback checked by check_profile.
• Resolver: MOEX addresses a security by its bare SECID, marked trusted.
• inferred_provider_config prefers MOEX for new MISX equities (same
  pattern as Börse Frankfurt for Xetra ISINs), so Yahoo (priority 1) is not
  tried first.
• Core wiring: DATA_SOURCE_MOEX, ProviderId::MOEX, client construction,
  e2e "disabled" list, provider settings info.

Why a migration

The quote client only constructs providers that have a row in
market_data_providers (MarketDataClient::new iterates enabled rows), so the
provider cannot be used without one. The migration inserts MOEX
(INSERT OR IGNORE, priority 14, enabled, no logo; the settings page already
handles a missing logo). It does not touch existing assets.

Out of scope

Bonds (ISS prices them in % of face on separate markets) and dividends.

Validation

Run in rust:1.98.1 (toolchain from rust-toolchain.toml):

• cargo fmt --all -- --check — clean
• cargo test --locked -p wealthfolio-market-data — 308 passed (16 new: parsing
  fixtures trimmed from real ISS responses, coverage, resolver)
• cargo test --locked -p wealthfolio-core — 2074 passed (incl. new
  test_moex_equity_prefers_moex)
• cargo test --locked -p wealthfolio-storage-sqlite — all passed (migration
  applies); portable_permissions needs an unprivileged runner, as the test
  itself states, and passes when run as a normal user
• cargo clippy --locked -p wealthfolio-market-data -p wealthfolio-core --all-targets --all-features -- -D warnings — clean
• cargo check --locked -p wealthfolio-server — ok
• Live smoke test (opt-in, #[ignore]):
  cargo test -p wealthfolio-market-data --test moex_live -- --ignored — passes
  against ISS: search, profile ISIN, latest quote, multi-page history (AFLT
  2020-02-26 close 108.22 matches ISS), delisted GDR history, unknown SECID error.

Not run: wealthfolio-app (Tauri) compilation and frontend checks — no
frontend or Tauri code changed.

Checklist

• I have read and agree to the
  Contributor License Agreement.

By submitting this PR, I agree to the
CLA.

🤖 Generated with Claude Code