fix: Bybit shared HTTP client, auth token bugs, consistent safe.ReadAllLimited

- Bybit: replace http.Get/http.DefaultClient with shared bybitHTTPClient (30s timeout, connection pooling)
- Frontend: fix resetPassword missing auth token (endpoint now requires auth)
- Frontend: fix SettingsPage using wrong localStorage key ('token' → 'auth_token')
- Agent: migrate remaining io.ReadAll(io.LimitReader()) to safe.ReadAllLimited for consistency
- Remove unused 'io' imports from brain.go and sentinel.go

trader/bybit/order_sync.go

@@ -71,8 +71,7 @@ func (t *BybitTrader) getTradesViaHTTP(startTime time.Time, limit int) ([]BybitT
 	req.Header.Set("X-BAPI-RECV-WINDOW", recvWindow)
 	req.Header.Set("Content-Type", "application/json")
 
-	// Use http.DefaultClient for the request
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := bybitHTTPClient.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("failed to call Bybit API: %w", err)
 	}