v0.11.8 — fix: moderate and low audit fixes

18 moderate and low audit fixes: order/cancel rate bucket separation, daily-loss circuit-breaker halt, persistent cancel failure escalation, live position query on flatten, simdjson reusable padded buffer, FlatBufferBuilder member (hot path alloc elimination), subscribe-error handling, WS ping timer at handshake, ACK timeout watchdog, Go WS frame caps, alert body size limit, SSRF webhook validation, atomic config write, bounded log tail, preflight PG password safety, WS reconnect backoff with jitter, frontend runtime validators. 8 new tests added.