fix: Bybit shared HTTP client, auth token bugs, consistent safe.ReadAllLimited

- Bybit: replace http.Get/http.DefaultClient with shared bybitHTTPClient (30s timeout, connection pooling)
- Frontend: fix resetPassword missing auth token (endpoint now requires auth)
- Frontend: fix SettingsPage using wrong localStorage key ('token' → 'auth_token')
- Agent: migrate remaining io.ReadAll(io.LimitReader()) to safe.ReadAllLimited for consistency
- Remove unused 'io' imports from brain.go and sentinel.go

trader/bybit/trader_orders.go

@@ -690,7 +690,7 @@ func (t *BybitTrader) GetOrderBook(symbol string, depth int) (bids, asks [][]flo
 
 	// Use HTTP request directly since the SDK doesn't expose GetOrderbook
 	url := fmt.Sprintf("https://api.bybit.com/v5/market/orderbook?category=linear&symbol=%s&limit=%d", symbol, depth)
-	resp, err := http.Get(url)
+	resp, err := bybitHTTPClient.Get(url)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to get order book: %w", err)
 	}