Deliver BAT-005: KIS token Redis cache (REQ-016, minor-change)

Port the trex-orbit Redis token-cache pattern so the KIS access token
survives daemon restarts and is shared across processes, avoiding KIS
token-issuance rate limits. KISBroker._ensure_token now resolves L1
in-memory -> L2 cache -> issue, storing issued tokens back to the cache.

- adapters/broker/token_cache.py: TokenCache protocol + RedisTokenCache
  (key trex:broker:kis:{account_ref}:token, token+expiry+app_key suffix
  JSON, ex=ttl, best-effort with graceful fallback) + InMemoryTokenCache.
- kis.py: optional token_cache injection.
- runtime config/daemon: TREX_KIS_REDIS_URL wires a RedisTokenCache.
- pyproject: redis>=5.

Verification: 96 passed, ruff clean — cache hit avoids issuance, cache is
shared across instances (restart/multi-process survival), backend errors
fall back to issuance (no regression), and app_key-suffix mismatch
invalidates a stale cache. Tested deterministically with an in-memory
double (no Redis server required). Processed via the minor-change fast
path: REQ-016 -> Implemented, BAT-005 (batch-lite) -> release-candidate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

trex_core/runtime/config.py

@@ -28,6 +28,7 @@ class KISConfig:
     account_ref: str
     timeout: float
     allow_live: bool
+    redis_url: str = ""   # REQ-016: optional token cache backend
 
 
 @dataclass(frozen=True)
@@ -58,6 +59,7 @@ class DaemonConfig:
                 account_ref=os.environ["TREX_KIS_BROKER_ACCOUNT_REF"],
                 timeout=float(os.environ.get("TREX_KIS_BROKER_TIMEOUT", "5")),
                 allow_live=os.environ.get("TREX_KIS_ALLOW_LIVE", "").lower() in ("1", "true", "yes"),
+                redis_url=os.environ.get("TREX_KIS_REDIS_URL", ""),
             )
         return DaemonConfig(
             dsn=dsn,