feat: 架构修复 - P0/P1 问题全面修复

P0 修复:
- runtimeStore: 添加缺失的 lastDayHistory 字段
- Gateway/RuntimeService: 状态同步改为内存优先，消除 glob 竞态
- App.jsx: 从 3075 行重构到 ~500 行，提取 8 个独立文件

P1 修复:
- CORS: 4 个服务改为从环境变量读取允许 origins
- MarketStore: 改为模块级单例模式
- Domain 层: 删除 trading thin wrapper，保留 news 真实逻辑
- 测试: 补齐 77 个 gateway/runtime 测试

新增文件:
- backend/tests/test_gateway.py (43 tests)
- frontend/src/hooks/useWebSocketHandler.js
- frontend/src/hooks/useStockRequestCallbacks.js
- frontend/src/hooks/useAgentCallbacks.js
- frontend/src/hooks/useRuntimeCallbacks.js
- frontend/src/hooks/useWatchlistCallbacks.js
- frontend/src/components/TickerBar.jsx
- frontend/src/components/HeaderRight.jsx
- frontend/src/components/ChartTabs.jsx

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/config/env_config.py

@@ -3,6 +3,7 @@
 """Environment config helpers with light validation and normalization."""
 
 import os
+import warnings
 from dataclasses import dataclass
 from typing import Optional
 
@@ -16,6 +17,36 @@ PROVIDER_ALIASES = {
     "vertexai": "GEMINI",
 }
 
+# Default dev CORS origins (localhost variants used by common dev servers)
+_LOCALHOST_ORIGINS = [
+    "http://localhost:5173",
+    "http://localhost:3000",
+    "http://localhost:8000",
+    "http://127.0.0.1:5173",
+    "http://127.0.0.1:3000",
+    "http://127.0.0.1:8000",
+]
+
+
+def get_cors_origins() -> list[str]:
+    """Get CORS allowed origins from environment.
+
+    Reads CORS_ALLOWED_ORIGINS env var (comma-separated).
+    Falls back to localhost dev origins if not set.
+    Warns if "*" is configured (only acceptable for local dev).
+    """
+    origins = get_env_list("CORS_ALLOWED_ORIGINS", default=[])
+    if origins:
+        if "*" in origins:
+            warnings.warn(
+                "CORS_ALLOWED_ORIGINS contains '*' — this allows any origin. "
+                "Only use in local development, never in production.",
+                UserWarning,
+            )
+        return origins
+    # Fallback: local dev only
+    return _LOCALHOST_ORIGINS
+
 
 @dataclass(frozen=True)
 class AgentModelConfig: