feat: add Tushare-first trusted data pipeline

[Shadowell]

Summary

• add an optional Tushare-first client for stock master data, trade calendar, and daily bars
• keep Eastmoney/Sina as explicit fallbacks and persist source / fallback_reason
• normalize Tushare daily amount from thousand RMB to RMB
• fix the Sina trade-calendar parser so it never injects 1992-05-04
• expose the active data-source contract through /api/jobs/kline-cache/data-source
• fix .env propagation in start.sh and start the API in GitHub Actions
• document configuration, source priority, formats, and units

Verification

• python3 -m pytest -q: 124 passed
• API regression suite: 66 passed
• live Tushare checks:
  • stock_basic: 5,539 rows
  • trade_cal: 483 open dates
  • daily(2026-08-07): 5,535 rows
• local service status: Tushare enabled, configured, and ready
• no token or secret is tracked; runtime credentials remain in ignored .env

Data contract

Tushare daily.vol remains in lots. Tushare daily.amount is converted from thousand RMB to RMB before persistence. Cached K-lines now include provider provenance.

Closes #1