feat(signal): Type SecurityFact, and align Signal with the RPC contract

[huacnlee]

Follow-up to #577, now checked against the lb.facts.mcp / QuerySignals RPC definitions and against production data.

SecurityFact is typed

security_facts returned Vec<serde_json::Value> because the endpoint served an empty facts array for every symbol. It now serves data:

pub struct SecurityFact {
    pub fact_id: String,
    pub fact_type: FactType,      // News | Fundamental | Technical
    pub direction: FactDirection, // long | short | neutral
    pub occur_time: OffsetDateTime,
    pub symbols_info: Vec<FactSymbol>,
    pub factors: Vec<FactFactor>,
    pub data_source: Vec<FactDataSource>,
    pub nl_info: FactNlInfo,
}

Matches the Fact / Factor / AnomalyDetection / SymbolInfo / DataSource / NLInfo messages field for field. NLInfo's optional invest_anal / eli_explain deserialize from an absent key.

nl_info keeps its raw strings. summary, invest_anal and eli_explain each carry a JSON array of {tag, value} inside a string. Parsing them during deserialization would let an upstream change fail the whole call, so the strings are kept verbatim and summary_tags() / invest_anal_tags() / eli_explain_tags() read them, returning an empty list on anything unexpected.

Signal follows the contract

• status is a SignalStatus enum — pending / active / deleted / ai-failed / filtered-by-manual / ai-submit-failed, per the field's documented values, with an Unknown fallback.
• total is i32, matching QuerySignalsResponse.
• risk_level and display_control are dropped. Neither is in the Signal message, and production returns neither — they only ever appeared on staging.
• catalyst_name vs key_catalyst is now documented. The filter matches the triggering factor's name (EARNINGS_RELEASED, macd_12_26_9); key_catalyst is prose for display (Q1 Revenue Surge). Filtering by the value you see in key_catalyst returns nothing, so both fields say which is which.

symbols_info drops counter_id in favour of the symbol already present, matching how Signal is modelled. Symbol parameter docs say "security symbol" instead of naming a ticker.region format.

Verification

Against 100 production facts for 700.HK:

• Every field in the response is modelled — the response's field-path set matches the struct exactly.
• fact_type resolves for all 100 (News 91 / Technical 7 / Fundamental 2); direction resolves for all 100 (long 85 / short 9 / neutral 6), and so does every nested factors[].long_short_direction. Nothing fell through to Unknown.
• summary_tags() and invest_anal_tags() parse on all 100, eli_explain_tags() on the 93 carrying the field.

neutral and nl_info.eli_explain were both found this way — neither appeared in the first sample this PR started from.

Two things to flag on the server side

• The list still returns json_data. The Signal message is annotated as list-scenario abbreviated info "不含 json_data / recommend_by / expression", but GET /v1/signals returns all three; json_data averages 11 KB per signal, so a default page of 20 is ~220 KB.
• limit / offset return 500 code 13 on both access points, while every other filter works. Reported separately.

🤖 Generated with Claude Code