refactor(V2): IBKR OAuth — named constants, explicit raises, lifted import

Code review fixes (commit 92da6aa):
- LST refresh buffer / fallback TTL extracted as named module constants
- Replace `assert` with explicit `if/raise` (asserts stripped under -O)
- Move IBKRAuthError above OAuth1aSigner (forward declaration)
- async_client import lifted to module level
- Test uses actual prime (23) instead of composite (255)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/exchanges/ibkr/test_oauth.py

@@ -114,14 +114,13 @@ async def test_live_session_token_mint(httpx_mock: HTTPXMock, tmp_path):
         },
     )
 
-    from cerbero_mcp.exchanges.ibkr.oauth import OAuth1aSigner
     signer = OAuth1aSigner(
         consumer_key="TEST_CK",
         access_token="TEST_AT",
         access_token_secret=encrypted_hex,
         signature_key_path=str(tmp_path / "sig.pem"),
         encryption_key_path=str(tmp_path / "enc.pem"),
-        dh_prime="ff",
+        dh_prime="17",  # 23 — smallest prime > 16 that fits a 1-byte modulus
     )
     lst = await signer.get_live_session_token(
         base_url="https://api.ibkr.com/v1/api"