feat(V2): unified /mcp interface; retire Bybit/Alpaca to old/

Add a common cross-exchange interface (/mcp) over the integrated venues
(deribit, hyperliquid):

- get_instruments: uniform schema where each row carries its own
  `exchange`, `fees` (maker/taker, live from Deribit, null where the
  venue has no per-instrument schedule) and `history_start` (listing
  date, live from Deribit creation_timestamp), plus type/tick_size and a
  lossless `native` blob. Optional `exchange` filter; fan-out otherwise.
- get_historical: generalized to {exchange, instrument, interval,
  start_date, end_date}, returning a single chosen venue's candles.
  Consensus merge stays available on /mcp-cross.

New: routers/unified.py, exchanges/cross/instruments.py (normalizers),
UnifiedClient in cross/client.py, schemas in cross/tools.py. Deribit
get_instruments now also surfaces maker/taker_commission and
creation_timestamp (additive).

Retire Bybit and Alpaca from the API surface: move clients, routers,
settings classes and their tests under old/ (history preserved via
git mv); drop them from the builder, /mcp-cross dispatch and symbol_map.
Bybit remains a public funding/OI data source in sentiment (not the
trading client). IBKR is intentionally excluded from /mcp for now.

Docs: rewrite API_REFERENCE.md (remove Bybit/Alpaca, document /mcp,
clarify that data_timestamp is injected globally by middleware).

Tests: add unified-interface coverage; update cross/settings/builder/boot
tests for the reduced venue set. Fix a pre-existing flaky assertion in
the Hyperliquid signing test (r/s use eth_utils.to_hex like the official
SDK, so a leading zero byte yields <66 chars ~1/256 of the time).

323 passed, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/exchanges/hyperliquid/test_client.py

@@ -277,8 +277,14 @@ async def test_place_order_limit(httpx_mock: HTTPXMock, client: HyperliquidClien
     assert order["t"] == {"limit": {"tif": "Gtc"}}
     sig = body["signature"]
     assert set(sig.keys()) == {"r", "s", "v"}
-    assert sig["r"].startswith("0x") and len(sig["r"]) == 66
-    assert sig["s"].startswith("0x") and len(sig["s"]) == 66
+    # r/s are serialized with eth_utils.to_hex (same as the Hyperliquid SDK),
+    # which emits minimal-length hex: a leading zero byte yields < 66 chars
+    # (~1/256 of signatures). Assert a valid <= 32-byte big-endian int, not a
+    # fixed length.
+    assert sig["r"].startswith("0x") and 2 < len(sig["r"]) <= 66
+    assert sig["s"].startswith("0x") and 2 < len(sig["s"]) <= 66
+    assert 0 < int(sig["r"], 16) < 2**256
+    assert 0 < int(sig["s"], 16) < 2**256
     assert sig["v"] in (27, 28)