feat(store): BacktestStore Protocol + LocalDirStore (epic #540 phase 3a)

[MDUYN]

Stacked on #543 (feature/iaf-index-cli), which is itself stacked on #537. Merge order: #537 → #543 → this PR. The diff shown here is just the single Phase 3a commit on top of #543.

First slice of Phase 3 of epic #540 — introduces the storage seam that decouples where a backtest is persisted from the rest of the framework.

What's in this PR

BacktestStore Protocol

A runtime-checkable Protocol with the minimum contract every backtest store must satisfy:

class BacktestStore(Protocol):
    def write(self, backtest, *, handle=None) -> StoreHandle: ...
    def open(self, handle, *, summary_only=False) -> Backtest: ...
    def exists(self, handle) -> bool: ...
    def delete(self, handle) -> None: ...
    def iter_handles(self) -> Iterator[StoreHandle]: ...
    def iter_index_rows(self) -> Iterator[BacktestIndexRow]: ...
    def __len__(self) -> int: ...

Semantics mirror today's Backtest.save_bundle / Backtest.open exactly — LocalDirStore is a 1:1 adapter, so existing consumers (HTML report, iaf list / rank, MCP server) work unchanged.

Optional capability mixins

Capabilities not every store can or should implement are declared as separate runtime-checkable Protocols, so callers feature-test with isinstance(store, SupportsXxx):

• SupportsCopyFrom (this PR) — for iaf migrate-store (Phase 3d) and finterion push (closed-source). Default fallback is a per-handle write(src.open(h)) loop; tiered stores can override to dedup chunks during ingest.
• SupportsRelations (Phase 3+, closed-source) — strategy/version/report graph; only FinterionStore will implement it.
• SupportsContentAddressedChunks (Phase 3c) — Tier-3 dedup.

LocalDirStore

Thin adapter over today's .iafbt directory layout:

• Handles are bundle paths relative to the store root (e.g. "sweep_a/run_03.iafbt"), so moving the root directory does not invalidate any handle.
• .iafbt suffix is normalised — callers may omit it.
• Path-traversal guards reject handles that escape the root (../escape, absolute paths).
• Sidecar SqliteBacktestIndex (<root>/index.sqlite) is built lazily and incrementally — same machinery as iaf index — so iter_index_rows() does not re-decode bundles. Disable with use_index=False for one-shot scripts.
• copy_from(src) loops src.iter_handles() → write(src.open(h), handle=h).

Tests

19 new tests, all passing:

• Protocol + SupportsCopyFrom runtime conformance.
• write / open round-trip; summary_only honoured.
• default-handle derivation from algorithm_id.
• iter_handles / __len__ / __contains__.
• iter_index_rows returns typed BacktestIndexRow with relative paths; sidecar SQLite is created on first call; use_index=False skips sidecar.
• path-traversal rejection (../escape, absolute paths).
• copy_from with and without a handle subset.
• handle normalisation (suffix added).
• root auto-creation; open of missing handle raises StoreHandleNotFoundError; delete of missing handle is a no-op.

Targeted suite (tests/services/backtest_store/ + tests/services/backtest_index/ + tests/cli/): 86 / 86 passing.

What's next (still in Phase 3)

Slice	Scope
3b	LocalTieredStore Tier-1 (SQLite) + Tier-2 (per-project Parquet for snapshots / trades / orders / metric_series)
3c	Tier-3 content-addressed chunks (ohlcv, code, params, symbols) — where the 64 GB → 20 GB headline lives
3d	iaf migrate-store --from local-dir --to local-tiered + byte-identical backtest.export() / Backtest.import_() round-trip + the parameterised test fixture that runs every backtest test against both stores

Each slice will land as a separate stacked PR.