feat(V2): unified /mcp interface; retire Bybit/Alpaca to old/

Add a common cross-exchange interface (/mcp) over the integrated venues
(deribit, hyperliquid):

- get_instruments: uniform schema where each row carries its own
  `exchange`, `fees` (maker/taker, live from Deribit, null where the
  venue has no per-instrument schedule) and `history_start` (listing
  date, live from Deribit creation_timestamp), plus type/tick_size and a
  lossless `native` blob. Optional `exchange` filter; fan-out otherwise.
- get_historical: generalized to {exchange, instrument, interval,
  start_date, end_date}, returning a single chosen venue's candles.
  Consensus merge stays available on /mcp-cross.

New: routers/unified.py, exchanges/cross/instruments.py (normalizers),
UnifiedClient in cross/client.py, schemas in cross/tools.py. Deribit
get_instruments now also surfaces maker/taker_commission and
creation_timestamp (additive).

Retire Bybit and Alpaca from the API surface: move clients, routers,
settings classes and their tests under old/ (history preserved via
git mv); drop them from the builder, /mcp-cross dispatch and symbol_map.
Bybit remains a public funding/OI data source in sentiment (not the
trading client). IBKR is intentionally excluded from /mcp for now.

Docs: rewrite API_REFERENCE.md (remove Bybit/Alpaca, document /mcp,
clarify that data_timestamp is injected globally by middleware).

Tests: add unified-interface coverage; update cross/settings/builder/boot
tests for the reduced venue set. Fix a pre-existing flaky assertion in
the Hyperliquid signing test (r/s use eth_utils.to_hex like the official
SDK, so a leading zero byte yields <66 chars ~1/256 of the time).

323 passed, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/integration/test_app_boot.py

@@ -23,11 +23,14 @@ def test_app_boots_and_health_responds(monkeypatch):
     spec = r.json()
     paths = spec["paths"].keys()
     assert any(p.startswith("/mcp-deribit/") for p in paths)
-    assert any(p.startswith("/mcp-bybit/") for p in paths)
     assert any(p.startswith("/mcp-hyperliquid/") for p in paths)
-    assert any(p.startswith("/mcp-alpaca/") for p in paths)
     assert any(p.startswith("/mcp-macro/") for p in paths)
     assert any(p.startswith("/mcp-sentiment/") for p in paths)
+    # Unified common interface
+    assert any(p.startswith("/mcp/tools/") for p in paths)
+    # Bybit and Alpaca have been retired from the API surface
+    assert not any(p.startswith("/mcp-bybit/") for p in paths)
+    assert not any(p.startswith("/mcp-alpaca/") for p in paths)
 
 
 def test_apidocs_available_after_boot(monkeypatch):

tests/integration/test_env_routing.py

@@ -98,40 +98,6 @@ def test_deribit_mainnet_bearer_constructs_mainnet_client(app, monkeypatch):
     )
 
 
-# ── Bybit ────────────────────────────────────────────────────────────────────
-
-def test_bybit_testnet_bearer(app, monkeypatch):
-    capture = {}
-    _spy_constructor(monkeypatch,
-                     "cerbero_mcp.exchanges.bybit.client", "BybitClient",
-                     capture)
-    _force_rebuild(app)
-
-    c = TestClient(app, raise_server_exceptions=False)
-    c.post("/mcp-bybit/tools/environment_info", headers=_bearer_test())
-
-    assert capture, "BybitClient constructor non chiamato"
-    assert capture["kwargs"].get("testnet") is True, (
-        f"atteso testnet=True, kwargs={capture['kwargs']}"
-    )
-
-
-def test_bybit_mainnet_bearer(app, monkeypatch):
-    capture = {}
-    _spy_constructor(monkeypatch,
-                     "cerbero_mcp.exchanges.bybit.client", "BybitClient",
-                     capture)
-    _force_rebuild(app)
-
-    c = TestClient(app, raise_server_exceptions=False)
-    c.post("/mcp-bybit/tools/environment_info", headers=_bearer_live())
-
-    assert capture, "BybitClient constructor non chiamato"
-    assert capture["kwargs"].get("testnet") is False, (
-        f"atteso testnet=False, kwargs={capture['kwargs']}"
-    )
-
-
 # ── Hyperliquid ──────────────────────────────────────────────────────────────
 
 def test_hyperliquid_testnet_bearer(app, monkeypatch):
@@ -166,41 +132,6 @@ def test_hyperliquid_mainnet_bearer(app, monkeypatch):
     )
 
 
-# ── Alpaca ───────────────────────────────────────────────────────────────────
-
-def test_alpaca_testnet_bearer_uses_paper(app, monkeypatch):
-    """Alpaca usa paper=True al posto di testnet=True."""
-    capture = {}
-    _spy_constructor(monkeypatch,
-                     "cerbero_mcp.exchanges.alpaca.client", "AlpacaClient",
-                     capture)
-    _force_rebuild(app)
-
-    c = TestClient(app, raise_server_exceptions=False)
-    c.post("/mcp-alpaca/tools/environment_info", headers=_bearer_test())
-
-    assert capture, "AlpacaClient constructor non chiamato"
-    assert capture["kwargs"].get("paper") is True, (
-        f"atteso paper=True, kwargs={capture['kwargs']}"
-    )
-
-
-def test_alpaca_mainnet_bearer_uses_paper_false(app, monkeypatch):
-    capture = {}
-    _spy_constructor(monkeypatch,
-                     "cerbero_mcp.exchanges.alpaca.client", "AlpacaClient",
-                     capture)
-    _force_rebuild(app)
-
-    c = TestClient(app, raise_server_exceptions=False)
-    c.post("/mcp-alpaca/tools/environment_info", headers=_bearer_live())
-
-    assert capture, "AlpacaClient constructor non chiamato"
-    assert capture["kwargs"].get("paper") is False, (
-        f"atteso paper=False, kwargs={capture['kwargs']}"
-    )
-
-
 # ── Auth sanity ──────────────────────────────────────────────────────────────
 
 def test_no_bearer_returns_401(app):