v0.3.0

Trading-correctness release from the 2026-07 full-codebase review (#39, #40), peer-reviewed by Codex against the vendor documentation. Contains breaking changes.

Changed (BREAKING)

• Order acknowledgements now fail closed: an undocumented instruction status, unknown save_order
  text status, or numeric save_order status raises the new OrderStatusUnknownError (the order
  may or may not have been placed - verify order state before resubmitting). It is deliberately
  not an OrderRejectedError, so rejection-and-resubmit handlers never catch it.
• Business-status checking is domain-scoped per endpoint; read endpoints no longer raise
  OrderRejectedError for stored/historical rejected orders.
• The client-side rate limit is one aggregate 500-request/5-second window across all resource
  groups, matching CIAPI's documented server-wide budget.
• get_client_preferences_list(keys, client_account_id) - the bogus required string
  argument is gone.

Fixed

• Trade/order placement responses decode top-level Status/StatusReason as
  InstructionStatus/InstructionStatusReason (per the vendor messages guide); nested
  Orders[] uses OrderStatus. Instruction RedCard/Error now reject with the correct reason
  text; Pending no longer raises a false rejection (a double-order hazard); accepted
  instructions also check nested orders.
• save_order handles its documented text Status ("Success"/"Failure") instead of crashing.
• Thread-safe rate limiter; throttled retries without Retry-After wait the documented 1 second.
• Log-off clears the stored session token (only the one actually deleted); empty/whitespace
  logon tokens raise AuthenticationError; credential-less refresh raises ConfigurationError.
• Credential/token fields excluded from model repr().

See CHANGELOG.md.