feat(api): портфели, ручные события, правка инструментов и обзор по скоупам

CRUD портфелей (/portfolios), ручные события (POST /events, DELETE только для manual), PATCH /instruments/{id}, GET /analytics/overview — карточка на каждый скоуп одним запросом. Холдинги отдают logo_url и logo_color. openapi.json обновлён.

backend/src/fintracker/branding.py

@@ -0,0 +1,21 @@
+"""Issuer logos, as T-Invest publishes them (kept out of `sources/`: the API needs the URL,
+not the whole source registry).
+
+Every instrument the API describes carries a `brand` block: the name of a logo file and the
+brand's own colour. The pictures live on T-Bank's public CDN, need no key and answer with
+`access-control-allow-origin: *`, so a browser client can load them straight from there.
+"""
+
+from __future__ import annotations
+
+LOGO_HOST = "https://invest-brands.cdn-tinkoff.ru"
+LOGO_SIZE = 160
+"""The CDN serves 160, 320 and 640 px squares; a list row never needs more than the first."""
+
+
+def logo_url(logo_name: str | None) -> str | None:
+    """`sber.png` -> the URL of its 160 px picture; None when the instrument has no logo."""
+    if not logo_name:
+        return None
+    stem = logo_name.rsplit(".", 1)[0]
+    return f"{LOGO_HOST}/{stem}x{LOGO_SIZE}.png"