Add fail-closed Firstrade reconciliation receipt

[Pigbibi]

Summary

• Add an explicit, default-off Firstrade reconciliation receipt endpoint.
• Keep production client construction unbound: the existing login client may write session artifacts.
• Build only redacted hashes and reason codes from an injected read-only client.
• Mark unavailable execution-history semantics as a permanent fail-closed blocker.
• Default missing RUNTIME_TARGET_ENABLED to false.

Safety

• No production login/session client is constructed by this route.
• No order, cancel, account, baseline, CAS, or deployment-state write path is added.
• Missing immutable expected digests cannot permit ACTIVE_LKG.

Validation

• pytest -q tests/test_runtime_config_support.py tests/test_broker_reconciliation.py tests/test_request_handling.py — 64 passed
• ruff check application/broker_reconciliation.py main.py tests/test_broker_reconciliation.py tests/test_request_handling.py runtime_config_support.py tests/test_runtime_config_support.py
• git diff --check