feat(V2): unified /mcp interface; retire Bybit/Alpaca to old/

Add a common cross-exchange interface (/mcp) over the integrated venues
(deribit, hyperliquid):

- get_instruments: uniform schema where each row carries its own
  `exchange`, `fees` (maker/taker, live from Deribit, null where the
  venue has no per-instrument schedule) and `history_start` (listing
  date, live from Deribit creation_timestamp), plus type/tick_size and a
  lossless `native` blob. Optional `exchange` filter; fan-out otherwise.
- get_historical: generalized to {exchange, instrument, interval,
  start_date, end_date}, returning a single chosen venue's candles.
  Consensus merge stays available on /mcp-cross.

New: routers/unified.py, exchanges/cross/instruments.py (normalizers),
UnifiedClient in cross/client.py, schemas in cross/tools.py. Deribit
get_instruments now also surfaces maker/taker_commission and
creation_timestamp (additive).

Retire Bybit and Alpaca from the API surface: move clients, routers,
settings classes and their tests under old/ (history preserved via
git mv); drop them from the builder, /mcp-cross dispatch and symbol_map.
Bybit remains a public funding/OI data source in sentiment (not the
trading client). IBKR is intentionally excluded from /mcp for now.

Docs: rewrite API_REFERENCE.md (remove Bybit/Alpaca, document /mcp,
clarify that data_timestamp is injected globally by middleware).

Tests: add unified-interface coverage; update cross/settings/builder/boot
tests for the reduced venue set. Fix a pre-existing flaky assertion in
the Hyperliquid signing test (r/s use eth_utils.to_hex like the official
SDK, so a leading zero byte yields <66 chars ~1/256 of the time).

323 passed, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_exchanges_builder.py

@@ -22,27 +22,6 @@ async def test_build_client_deribit_returns_correct_url(monkeypatch):
     assert "test" not in c_live.base_url.lower()
 
 
-@pytest.mark.asyncio
-async def test_build_client_bybit_returns_correct_env(monkeypatch):
-    from tests.unit.test_settings import _minimal_env
-
-    for k, v in _minimal_env().items():
-        monkeypatch.setenv(k, v)
-
-    # BybitClient costruisce internamente httpx.AsyncClient: nessuna
-    # connessione reale finché non si invoca un metodo di rete.
-    from cerbero_mcp.exchanges import build_client
-    from cerbero_mcp.settings import Settings
-
-    s = Settings()
-    c_test = await build_client(s, "bybit", "testnet")
-    c_live = await build_client(s, "bybit", "mainnet")
-
-    assert c_test is not c_live
-    assert c_test.testnet is True
-    assert c_live.testnet is False
-
-
 @pytest.mark.asyncio
 async def test_build_client_hyperliquid_returns_correct_env(monkeypatch):
     from tests.unit.test_settings import _minimal_env
@@ -64,31 +43,6 @@ async def test_build_client_hyperliquid_returns_correct_env(monkeypatch):
     assert "test" not in c_live.base_url.lower()
 
 
-@pytest.mark.asyncio
-async def test_build_client_alpaca_returns_correct_env(monkeypatch):
-    from tests.unit.test_settings import _minimal_env
-
-    for k, v in _minimal_env().items():
-        monkeypatch.setenv(k, v)
-
-    # AlpacaClient (V2) usa httpx puro: il costruttore non apre connessioni
-    # reali (httpx.AsyncClient è lazy fino alla prima request), quindi nessuno
-    # stub SDK è necessario.
-    from cerbero_mcp.exchanges import build_client
-    from cerbero_mcp.settings import Settings
-
-    s = Settings()
-    c_test = await build_client(s, "alpaca", "testnet")
-    c_live = await build_client(s, "alpaca", "mainnet")
-    try:
-        assert c_test is not c_live
-        assert c_test.paper is True
-        assert c_live.paper is False
-    finally:
-        await c_test.aclose()
-        await c_live.aclose()
-
-
 @pytest.mark.asyncio
 async def test_build_client_macro_no_env_distinction(monkeypatch):
     from tests.unit.test_settings import _minimal_env
@@ -187,45 +141,6 @@ async def test_hyperliquid_url_from_env_overrides_default(monkeypatch):
     assert c._base_url_override == "https://hl-custom.example.com"
 
 
-@pytest.mark.asyncio
-async def test_bybit_url_from_env_overrides_default(monkeypatch):
-    """Bybit (httpx): override BYBIT_URL_TESTNET applica direttamente a
-    `self.base_url`, usato come base di ogni richiesta REST V5."""
-    from tests.unit.test_settings import _minimal_env
-
-    env = _minimal_env(BYBIT_URL_TESTNET="https://bybit-custom.example.com")
-    for k, v in env.items():
-        monkeypatch.setenv(k, v)
-
-    from cerbero_mcp.exchanges import build_client
-    from cerbero_mcp.settings import Settings
-
-    s = Settings()
-    c = await build_client(s, "bybit", "testnet")
-    assert c.base_url == "https://bybit-custom.example.com"
-
-
-@pytest.mark.asyncio
-async def test_alpaca_url_from_env_overrides_default(monkeypatch):
-    """Alpaca V2 (httpx): `base_url` override applica al solo trading
-    endpoint; data endpoints (data.alpaca.markets) restano hardcoded."""
-    from tests.unit.test_settings import _minimal_env
-
-    env = _minimal_env(ALPACA_URL_TESTNET="https://alpaca-custom.example.com")
-    for k, v in env.items():
-        monkeypatch.setenv(k, v)
-
-    from cerbero_mcp.exchanges import build_client
-    from cerbero_mcp.settings import Settings
-
-    s = Settings()
-    c = await build_client(s, "alpaca", "testnet")
-    try:
-        assert c.base_url == "https://alpaca-custom.example.com"
-    finally:
-        await c.aclose()
-
-
 @pytest.mark.asyncio
 async def test_build_client_unknown_exchange_raises(monkeypatch):
     from tests.unit.test_settings import _minimal_env