Audit fixes: LIVE symbols/fills/expiry/pending, security harden, add 更新说明.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_symbols.py

@@ -0,0 +1,33 @@
+"""LIVE 合约解析。"""
+
+from app.live.symbols import resolve_perp_inst_id
+
+
+class _FakeDb:
+    def __init__(self, row=None):
+        self._row = row
+
+    def fetchone(self, sql, args=()):
+        return self._row
+
+
+def test_resolve_perp_prefers_group(monkeypatch) -> None:
+    import app.live.symbols as sym
+
+    class S:
+        perp_inst_id = "ETH-USDT-SWAP"
+
+    monkeypatch.setattr(sym, "live_settings", lambda: S())
+    db = _FakeDb({"perp_inst_id": "ETHUSDT"})
+    assert resolve_perp_inst_id(db, group_id="g1") == "ETHUSDT"
+
+
+def test_resolve_perp_fallback_runtime(monkeypatch) -> None:
+    import app.live.symbols as sym
+
+    class S:
+        perp_inst_id = "ETHUSDT"
+
+    monkeypatch.setattr(sym, "live_settings", lambda: S())
+    db = _FakeDb(None)
+    assert resolve_perp_inst_id(db) == "ETHUSDT"