feat: add bounded KIS account read recovery

trex_core/adapters/broker/kis.py

@@ -12,6 +12,7 @@ Endpoints: /oauth2/tokenP (token), /uapi/domestic-stock/v1/trading/order-cash
 from __future__ import annotations
 
 import base64
+import hashlib
 import json
 from dataclasses import replace
 from datetime import datetime, time, timedelta, timezone
@@ -157,6 +158,11 @@ class KISBroker:
     def name(self) -> str:
         return "kis-mock" if self._mock else "kis-live"
 
+    def account_scope_hash(self) -> str:
+        """Stable non-secret identity for account-scoped persisted state."""
+        cano, product = self._account()
+        return hashlib.sha256(f"{cano}|{product}".encode()).hexdigest()
+
     # --- credential hot-swap (dcy-036 / REQ-113 AC-2 / REQ-115 AC-1) ----------
     def reinitialize(self, credential) -> None:
         """Replace app_key/app_secret/account_ref with fetched day-start credential.
@@ -711,8 +717,20 @@ class KISBroker:
             )
             response.raise_for_status()
             payload = response.json()
-        except (httpx.HTTPError, KeyError, TypeError, ValueError):
+        except BrokerBalanceError:
+            raise
+        except httpx.HTTPStatusError as exc:
+            status = exc.response.status_code if exc.response is not None else None
+            code = (
+                "authentication_failed"
+                if status == 401
+                else ("authorization_failed" if status == 403 else "transport_failed")
+            )
+            raise BrokerBalanceError(code) from None
+        except httpx.HTTPError:
             raise BrokerBalanceError("transport_failed") from None
+        except (KeyError, TypeError, ValueError):
+            raise BrokerBalanceError("malformed_response") from None
         if not isinstance(payload, dict):
             raise BrokerBalanceError("malformed_response")
         if str(payload.get("rt_cd")) != "0":