[GrantFox][High] Reconcile settlement results with portfolio balances

Summary

Reconcile settlement results with portfolio balances

Why this matters

A confirmed settlement must update positions and balances without duplicate optimistic application.

Scope

Add operation identity, authoritative reconciliation, and rollback behavior.

Acceptance criteria

• One settlement changes portfolio state once.
• Failed confirmation restores prior state.
• Late responses cannot overwrite newer data.
• Tests cover concurrent markets and refresh.

Validation

Add regression coverage for existing behavior, failure modes, authorization boundaries, and compatibility. The implementation must pass the repository CI checks.

Non-goals

• Typo-only, formatting-only, or documentation-only changes.
• Unrelated refactors or dependency upgrades.
• Weakening existing security, authorization, CI, or production safeguards.

Contributor application

Before implementation, comment with relevant experience, a 1–4 bullet approach, and an estimate for opening the first draft PR. Wait for maintainer assignment before coding.

PR requirements

Use a feature branch, include Closes #<issue-number>, check every acceptance criterion, link criteria to code/tests, explain security and failure-mode considerations, and pass CI.

Reward-readiness

This is a substantive GrantFox campaign issue. Merge and CI success do not by themselves guarantee reward eligibility; final reward-readiness is determined by campaign review.

No files or entry points are named. Start by tracing the existing settlement and portfolio-balance state flows and their tests, then run the repository CI checks. Done means one settlement applies once, failed confirmation restores prior state, late responses cannot replace newer data, and concurrent markets and refresh are covered by regression tests.