feat(quote): add QuoteTransport to serve quote pull APIs over HTTP - #604

## What

Ports longbridge/openapi#604 to the Go SDK. Adds `quote.Transport`
(`quote.TransportWebSocket`, default / `quote.TransportHTTP`), set with
`quote.WithTransport(...)`, `config.Config.QuoteTransport` or env
`LONGBRIDGE_QUOTE_TRANSPORT=ws|http`. With `TransportHTTP` the 20
`QuoteContext` pull methods backed by the 19 WebSocket commands that
have a REST equivalent (`StaticInfo`, `Quote`, `OptionQuote`,
`WarrantQuote`, `Depth`, `Brokers`, `Participants`, `Trades`,
`Intraday`, `Candlesticks`, `HistoryCandlesticksByOffset/ByDate`,
`OptionChainExpiryDateList`, `WarrantIssuers`, `WarrantList`,
`TradingSession`, `TradingDays`, `CapitalFlow`, `CapitalDistribution`,
`CalcIndex`) go over `POST /quote/*` instead of the quote WebSocket.
Method signatures and return types are unchanged.

## Why

Same motivation as the Rust PR: longbridge/longbridge-mcp#162
re-implemented every quote tool on the REST endpoints inside the MCP to
get rid of its per-user WebSocket pool. That belongs in the SDK, and Go
consumers should get the same switch.

## Usage

Opt in per context (default stays `TransportWebSocket`, so nothing
changes for existing users). Either set the env var:

```bash
export LONGBRIDGE_QUOTE_TRANSPORT=http   # ws (default) | http
```

or set it in code. After that, call the quote APIs exactly as before —
same methods, same return types:

From config / env (recommended — the quote WebSocket URL follows the
configured region):

```go
cfg, err := config.New()
if err != nil {
	return err
}
cfg.QuoteTransport = "http" // or LONGBRIDGE_QUOTE_TRANSPORT=http
qctx, err := quote.NewFromCfg(cfg) // no WebSocket is dialed here with HTTP
if err != nil {
	return err
}
defer qctx.Close()

quotes, err := qctx.Quote(context.Background(), []string{"700.HK", "AAPL.US"}) // POST /quote/quotes
```

With options:

```go
httpClient, err := http.NewFromCfg(cfg)
if err != nil {
	return err
}
qctx, err := quote.New(
	quote.WithHttpClient(httpClient),
	quote.WithTransport(quote.TransportHTTP),
	quote.WithQuoteURL(cfg.QuoteUrl), // needed outside the global region if you will subscribe
)
```

Notes:
- `Subscribe` / `Unsubscribe`, `Profile()` and APIs without a REST
equivalent still use the WebSocket, which is then dialed on first use;
`On*` callbacks registered before that are queued and attached when it
happens. A context that only calls the pull APIs never opens it. After
`Close` nothing re-dials (`quote.ErrClosed`).
- `WithEnableOvernight` keeps its meaning on both transports (US
overnight data is returned only when it is set).
- Comparison tool: `cd examples && go run ./quote_http_compare` calls
every pull API over both transports and prints both results with an
`EQUAL` flag per call.

## How

- `quote/transport.go`: `httpPaths` maps WebSocket commands to REST
paths; `core.do` branches on the transport. Requests are the same
protobuf messages encoded with `protojson` (proto field names, absent
sub-messages omitted). Responses go through `normalizeProtoJSON`, a
descriptor-driven pass that rewrites the gateway encodings protojson
rejects (`""` on numeric/enum fields, quoted enum numbers,
`"true"`/`"false"`/`1`/`0` on bools, numbers on string fields, `null`
list elements), then `protojson` (`DiscardUnknown`, so the extra
`volume_str` is ignored). A `null` `data` is an empty response.
- **Lazy WebSocket**: `newCore` no longer dials unconditionally. With
`TransportWebSocket` it dials and fetches the profile up front exactly
as before; with `TransportHTTP` the socket is dialed on first need
(`Subscribe`, `Profile()`, or any command without a REST path) via
`core.ws()`, with a context detached from the caller's cancellation.
Push handlers registered before the dial are queued and attached when it
happens. A socket whose authentication fails is closed rather than
leaked. After `Close()` nothing re-dials. `Subscribe` now returns the
subscribe error (it was dropped before, which a lazy dial would have
turned into silent failures).
- `quote/overnight.go` aligns the one known server-side difference: REST
always returns US overnight data and has no opt-out, while the WebSocket
only returns it with `WithEnableOvernight(true)`. On the HTTP path (and
only there) the SDK clears `OverNightQuote`, filters overnight
`Intraday` lines for US equities, and for `CandlestickTradeSessionAll`
history queries drops `OVERNIGHT_TRADE` bars and tops up
count/range-capped windows with offset queries (≤1000 per request, ≤8
rounds). Changes visible on the default WebSocket transport (all listed
in the CHANGELOG): `Subscribe` now returns the subscribe error instead
of always `nil`; `Close` is idempotent (a second call used to panic) and
final; the socket is closed if the initial profile query fails;
`LONGBRIDGE_ENABLE_OVERNIGHT` is now read (users who set it per the
README will start receiving US overnight data); the `Brokers`
region-restriction error text is `quote/brokers`. `http.Client.Call`
returns an empty `*json.RawMessage` instead of `EOF` for a JSON response
without `data` (a non-JSON 200 is still an error).
- `examples/quote_http_compare` calls every pull API over both
transports and diffs the JSON output.

## Verification

- `go test -race ./quote/` passes (new tests: refill paging incl. the
overnight-block jump in both directions, `alignCandlesticks` /
`windowTarget` early exits and capped/uncapped date ranges, US overnight
window in EDT/EST, command→path map completeness, gateway proto-JSON
decode replay and normalisation edge cases, request encoding).
- New tests also cover `httpDo` end to end against `httptest` (request
path/body, absent and `null` `data`, a non-JSON 200, API errors) and the
closed-context lifecycle (never dialed and dialed-then-closed). The two
failing `config` package tests (`Test_YamlConfig` / `Test_TomlConfig`)
fail identically on `main` (missing fixture files) and are unrelated.
- Follow-up commits address review (`WithTransport` validation,
fail-fast `New` without an HTTP client, proto-JSON normalisation,
`Subscribe` error, close/leak handling, date-range capped rule aligned
with the Rust port). Please squash on merge.
- `go vet ./quote/` reports only the pre-existing `copylocks` warnings
from `util.Copy` (same 8 on `main`).
- `examples/quote_http_compare` against a staging environment: 30/32
cases identical between transports with overnight both off and on; the 2
remaining are the gateway error-code gap below. Production: all
successful cases structurally identical; remaining value-level
differences come from inconsistent `/quote/*` replicas (see below).

## Known gateway gaps (not fixable in the SDK)

1. REST reports business errors as `500 internal server error` instead
of passing the code through (WS: `301600`, `301604`, `301607`).
2. Production `/quote/*` replicas are not consistent with each other
(value-level differences in `avg_price`/`volume`; two consecutive REST
calls can disagree while the WS is stable).
3. No REST opt-out for US overnight data (handled client-side here as a
stopgap; `quote/overnight.go` should be removed once the REST endpoints
honour `need_over_night_quote`).

Follow-up (not in this PR): a client-side rate limit for the HTTP path;
reading `LONGBRIDGE_LANGUAGE` (same class of env-tag bug as
`LONGBRIDGE_ENABLE_OVERNIGHT`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Release **v5.2.1**. Bumps workspace `5.2.0` → `5.2.1`.

### New since v5.2.0
- **Added:** `OrderStatus::DelayedNotReported` — monitoring, the state a
time-condition order sits in before it is reported to the exchange;
appended after `PartialWithdrawal` so C/C++/Node.js discriminants stay
stable (#595)
- **Added:** time-condition orders — `delayed_until` on submit /
multi-leg submit (held in `DelayedNotReported` and sent at that time, ≤
90 days ahead; multi-leg `LO` / `MO` only) and on replace (move the
time, or `clear_delayed_until` to turn it back into a regular order);
`Order` / `OrderDetail` gain `delayed_until`. Across Rust, C, C++, Java,
Node.js and Python (the Go SDK ships separately, openapi-go#123) (#595)
- **Added:** `QuoteTransport` config option to serve quote pull APIs
over HTTP, exposed in every binding layer (#604)

Only `Cargo.toml` (workspace version + internal dep reqs) and
`CHANGELOG.md` change.

🤖 Generated with [Claude Code](https://claude.com/claude-code)