fix: symbol-case position lookup, shadow order ids, Alpaca short sign and zero fills, bar windows

[quantum-like]

Owning issue

Closes #111

Outcome

5 correctness fixes, one commit each, each with a focused test:

• Position lookup on the safety facade and the strategy wrapper used the caller's casing, so close_position("aapl") left an AAPL position open. Lookups now use the same uppercase symbol as the broker adapters. Test: tests/unit/test_safe_broker.py::test_position_lookup_and_close_ignore_symbol_case, ::test_external_position_lookup_ignores_symbol_case. (f95d914)
• Shadow order ids were millisecond timestamps, so two accepts in the same millisecond collided in reconciliation. Ids now come from a per-broker sequence. Test: tests/unit/test_safe_broker.py::test_shadow_order_ids_stay_unique_when_the_clock_does_not_advance. (bd6a6a2)
• Alpaca reports an unsigned qty plus a separate side, so short positions were stored as longs and a later close sold into the short. Shorts are now stored with a negative quantity. Test: tests/unit/test_alpaca_broker.py::test_sync_positions_signs_short_holdings. (dc84667)
• An Alpaca fill event with filled_qty 0/absent was recorded as a complete fill. It is now rejected. Test: tests/unit/test_alpaca_broker.py::test_fill_event_does_not_invent_a_quantity. (e5a518f)
• Aggregated bars whose length does not divide 60 minutes (e.g. 90 minutes) restarted every hour. Windows now align to midnight; hour-dividing sizes are unchanged. Test: tests/unit/test_bar_aggregator.py::test_bar_windows_do_not_restart_at_the_hour. (8fd83f5)

Compatibility

• No public compatibility impact
• Compatibility impact is documented in the owning issue and migration guidance

No API changes. Behavior changes only in the cases above.

Verification

• Tests reproduce the prior failure or verify the requested behavior (each listed test fails on main and passes with its fix)
• Ruff lint and format checks pass (ruff format --check is clean on the changed files and ruff check reports nothing new in them versus main, but I did not run the full pre-commit suite)
• ty passes (not run on this branch)
• Test suite passes: pytest: 1050 passed, 30 skipped before; 1056 passed, 30 skipped after. The skipped tests need external/paper/stress/benchmark flags and were left off, so no broker or live feed was touched.
• Package build passes when applicable (not run)
• Strict MkDocs build passes when documentation is affected (no documentation changes)
• Ecosystem qualification passes (not run)

Documentation and release

No documentation changes. The behavior changes above may be worth a line in the next patch-release notes.

Amir

[stefan-jansen]

The five repairs from this contribution are retained and completed in the combined maintenance PR #121, including the original quantum-like/Cursor Agent credit and the failing-base/passing-fix evidence. Closing this PR as superseded avoids duplicate integration work; issue #111 remains open and is linked for closure when #121 actually merges. The original contributor branch is preserved. This closure does not claim the repairs have landed.