Add byte-exact mt5-cli project backtests

[sindlinger]

What changed

• adds an explicit project-mode POST /backtest contract for mt5-cli
• validates the complete manifest and ZIP by path, size and SHA-256
• materializes EXP/IND/SCR/SRV/INC/LBR/PRS/TPL/FLS as physical remote trees under the job lock
• captures raw submitted/runtime evidence, log deltas and created/modified FLS outputs
• restores the pre-run module and report trees byte for byte
• adds exact job ownership for status, tail and cancellation without process-name killing
• preserves the existing ad-hoc backtest flow; project mode never falls back to it

Validation

• python3 -m py_compile mt5api/config.py mt5api/server.py mt5api/backtest/handler.py mt5api/backtest/jobs.py mt5api/backtest/materialization.py tests/test_project_materialization.py
• python -m pytest -q tests --ignore=tests/real: 161 passed
• real filesystem contract: applies actual EXP/PRS/FLS bytes, captures modified/created FLS files and restores prior trees byte exactly
• byte-exact cross-client contract with the companion mt5-cli implementation verified manifest, ZIP, output manifest/archive and returned CSV SHA-256

Still required before merge

A configured Windows VM must run a real Strategy Tester job through the HTTP endpoint using an authorized URL/token. This PR remains draft until that current-run evidence is attached. No local or remote backend fallback is implemented.

[sindlinger]

Preparação do E2E em 2026-07-20:

• nenhuma implantação/serviço/container mt5-httpapi foi encontrado nesta máquina
• MT5_HTTPAPI_BASE_URL e MT5_HTTPAPI_TOKEN estão ausentes do ambiente protegido atual
• o servidor exige conta real configurada com login/password/server; esses valores não serão copiados ou impressos manualmente
• o cli-duka-account local não possui uma superfície protegida de provisionamento do servidor e imprime credenciais em stdout, portanto não foi executado diretamente

O E2E real requer uma VM mt5-httpapi já provisionada e um token instalado no ambiente protegido do broker. Ausência permanece explícita; nenhum servidor local falso ou backend alternativo foi usado.

[sindlinger]

Local validation update (2026-07-20):

• Disposable test environment used; repository files were not modified by dependency installation.
• Unit/materialization suite: 161 passed (tests/real intentionally excluded because no live API endpoint/token exists).
• Existing cross-client evidence remains under the recorded real-httpapi-contract-evidence directory.
• No remote E2E was claimed or executed: this machine has no configured mt5-httpapi URL or token.
• No credentials were requested, printed, or persisted.