fix: market expiry guard, FAK orders, 2% slippage, sanitize CLOB logs

Market expiry guard (executor.js):
- getMarketOptions() now returns endDateIso, active, acceptingOrders
  from Gamma API response
- executeBuy() skips immediately if market is closed / not accepting orders
- executeBuy() skips if market closes within MIN_MARKET_TIME_LEFT seconds
  (default 300 s = 5 min), logging exact time remaining
- Add MIN_MARKET_TIME_LEFT to config and .env.example

FAK + 2% slippage (executor.js):
- Replace OrderType.FOK with OrderType.FAK for both BUY and SELL
  market orders — eliminates "FOK fully filled or killed" failures
- Reduce slippage from 5% to 2% (price * 1.02 / price * 0.98)
- Fix zero-fill detection: FAK success with 0 shares logs "no liquidity"
  and retries instead of recording a phantom fill

CLOB log sanitization (logger.js + index.js):
- Add sanitizeClobMessage(): strips axios config object (auth headers)
  from [CLOB Client] dumps, keeps only HTTP status + error string
- Add interceptConsole(): overrides console.error/warn globally
- Call interceptConsole() at startup in index.js

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/utils/logger.js

@@ -22,6 +22,26 @@ const B = {
 
 let outputFn = null; // When set, all log goes here (blessed dashboard mode)
 
+/**
+ * Sanitize a CLOB client console message.
+ * Strips the full axios config (which may contain auth headers) and returns
+ * only the HTTP status code + API error message.
+ */
+function sanitizeClobMessage(raw) {
+    if (!raw.includes('[CLOB Client]')) return raw;
+    try {
+        const jsonStart = raw.indexOf('{');
+        if (jsonStart === -1) return raw;
+        const parsed = JSON.parse(raw.slice(jsonStart));
+        const status  = parsed.status  || '';
+        const errMsg  = parsed.data?.error || parsed.statusText || 'unknown error';
+        const prefix  = raw.slice(0, jsonStart).trim();
+        return `${prefix}: ${status} — ${errMsg}`;
+    } catch {
+        return raw;
+    }
+}
+
 function ts() {
     return new Date().toISOString().replace('T', ' ').substring(0, 19);
 }
@@ -55,6 +75,25 @@ const logger = {
     setOutput(fn) {
         outputFn = fn;
     },
+
+    /**
+     * Override console.error and console.log globally so that the CLOB client's
+     * internal axios error dumps are sanitized (no auth headers / full config).
+     * Call this once at startup, before any CLOB requests.
+     */
+    interceptConsole() {
+        const handle = (originalFn, logFn) => (...args) => {
+            const raw = args.map((a) => (a && typeof a === 'object' ? JSON.stringify(a) : String(a))).join(' ');
+            const sanitized = sanitizeClobMessage(raw);
+            if (sanitized !== raw || raw.includes('[CLOB Client]')) {
+                logFn(sanitized);
+            } else {
+                originalFn(...args);
+            }
+        };
+        console.error = handle(console.error.bind(console), logger.error);
+        console.warn  = handle(console.warn.bind(console),  logger.warn);
+    },
 };
 
 export default logger;