feat(V2): unified /mcp interface; retire Bybit/Alpaca to old/

Add a common cross-exchange interface (/mcp) over the integrated venues
(deribit, hyperliquid):

- get_instruments: uniform schema where each row carries its own
  `exchange`, `fees` (maker/taker, live from Deribit, null where the
  venue has no per-instrument schedule) and `history_start` (listing
  date, live from Deribit creation_timestamp), plus type/tick_size and a
  lossless `native` blob. Optional `exchange` filter; fan-out otherwise.
- get_historical: generalized to {exchange, instrument, interval,
  start_date, end_date}, returning a single chosen venue's candles.
  Consensus merge stays available on /mcp-cross.

New: routers/unified.py, exchanges/cross/instruments.py (normalizers),
UnifiedClient in cross/client.py, schemas in cross/tools.py. Deribit
get_instruments now also surfaces maker/taker_commission and
creation_timestamp (additive).

Retire Bybit and Alpaca from the API surface: move clients, routers,
settings classes and their tests under old/ (history preserved via
git mv); drop them from the builder, /mcp-cross dispatch and symbol_map.
Bybit remains a public funding/OI data source in sentiment (not the
trading client). IBKR is intentionally excluded from /mcp for now.

Docs: rewrite API_REFERENCE.md (remove Bybit/Alpaca, document /mcp,
clarify that data_timestamp is injected globally by middleware).

Tests: add unified-interface coverage; update cross/settings/builder/boot
tests for the reduced venue set. Fix a pre-existing flaky assertion in
the Hyperliquid signing test (r/s use eth_utils.to_hex like the official
SDK, so a leading zero byte yields <66 chars ~1/256 of the time).

323 passed, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_settings.py

@@ -14,19 +14,11 @@ def _minimal_env(**overrides) -> dict:
         "DERIBIT_CLIENT_SECRET": "secret",
         "DERIBIT_URL_LIVE": "https://www.deribit.com/api/v2",
         "DERIBIT_URL_TESTNET": "https://test.deribit.com/api/v2",
-        "BYBIT_API_KEY": "k",
-        "BYBIT_API_SECRET": "s",
-        "BYBIT_URL_LIVE": "https://api.bybit.com",
-        "BYBIT_URL_TESTNET": "https://api-testnet.bybit.com",
         "HYPERLIQUID_WALLET_ADDRESS": "0xabc",
         "HYPERLIQUID_API_WALLET_ADDRESS": "0xdef",
         "HYPERLIQUID_PRIVATE_KEY": "0x123",
         "HYPERLIQUID_URL_LIVE": "https://api.hyperliquid.xyz",
         "HYPERLIQUID_URL_TESTNET": "https://api.hyperliquid-testnet.xyz",
-        "ALPACA_API_KEY_ID": "k",
-        "ALPACA_SECRET_KEY": "s",
-        "ALPACA_URL_LIVE": "https://api.alpaca.markets",
-        "ALPACA_URL_TESTNET": "https://paper-api.alpaca.markets",
         "FRED_API_KEY": "x",
         "FINNHUB_API_KEY": "y",
         "CRYPTOPANIC_KEY": "z",
@@ -49,8 +41,7 @@ def test_settings_load_minimal(monkeypatch):
     assert s.testnet_token.get_secret_value() == "t_test_123"
     assert s.mainnet_token.get_secret_value() == "t_live_456"
     assert s.deribit.url_testnet.endswith("test.deribit.com/api/v2")
-    assert s.bybit.max_leverage == 3
-    assert s.alpaca.max_leverage == 1
+    assert s.deribit.max_leverage == 3
 
 
 def test_settings_missing_token_fails(monkeypatch, tmp_path):