MtApi5: composite GetPositions/GetOrders snapshots (one round-trip)

[biohazardxxx]

Summary

Reading positions/orders through the property API is an N+1 round-trip pattern: PositionsTotal + PositionGetTicket(i) + one RPC per property. With command latency dominated by the expert's wake-up cadence, reading 10 properties of 20 positions costs 200+ round-trips.

This PR adds two composite snapshot commands that return everything in one round-trip:

id	Method	Returns
390	List<Mt5Position>? GetPositions()	every open position with all properties
391	List<Mt5Order>? GetOrders()	every pending order with all properties

New DTOs Mt5Position (18 properties) and Mt5Order (22 properties) cover the full POSITION_*/ORDER_* property surface (times incl. msc, prices, volumes, SL/TP, magic, state/reason/type enums, comment, external id).

Implementation notes

• Wire format follows the MqlRates house pattern: settable long MtTime* unix-seconds properties carry the wire value; DateTime properties are computed via Mt5TimeConverter (get-only, not serialized).
• The MQL5 handlers select each element via PositionGetTicket(i) / OrderGetTicket(i); a ticket of 0 (element vanished between Total() and selection — a live-trading race) skips the element rather than failing the snapshot.
• Broker-controlled strings (Symbol/Comment/ExternalId) are escaped at the call site (backslash first, then quote/\n/\r/\t) since json.mqh's JSONString.toString() performs no escaping. If escaping is later added to json.mqh (see Fix invalid JSON from unescaped backslashes in MQL5 string serialization #294), these call sites must be reverted in the same change.
• Purely additive; no existing behavior changed.

Testing

• MtApi5 builds 0 warnings/0 errors; test client builds clean; MtApi5.mq5 compiles Result: 0 errors, 0 warnings (recompiled .ex5 included).
• Adversarial review traced ids/keys/enums end-to-end and validated deserialization with byte-exact replicas of the EA's JSON output (24/24 checks incl. escaping round-trips, enum decoding, msc times, long.MaxValue tickets).
• Runtime-verified against a live MT5 terminal (build 5830): GetPositions()/GetOrders() return non-null empty lists on a flat account and match PositionsTotal()/OrdersTotal(). The populated path was validated via the wire-replica tests only — no live positions were opened (test terminal ran with trading disabled).

🤖 Generated with Claude Code