[codex] Add IB Gateway API health recovery

[Pigbibi]

Summary

Adds a real IB API handshake readiness check for the Gateway container, plus automated recovery so Cloud Run does not depend on TCP-only port health.

What changed

• Replaced TCP-only readiness with an IB API v100+ handshake that waits for nextValidId or managedAccounts.
• Added a systemd health watcher that restarts ib-gateway when the API handshake fails.
• Added a daily Gateway restart timer to reduce long-running IB Gateway stuck states.
• Wired the installer into both keepalive and full deploy workflow paths.
• Added tests for handshake retry behavior, recovery script coverage, and workflow wiring.

Validation

• bash tests/test_wait_for_ib_gateway_ready.sh
• bash tests/test_gateway_recovery_scripts.sh
• bash tests/test_workflow_shared_config.sh
• bash tests/test_docker_compose_ports.sh
• bash tests/test_install_2fa_bot_watcher.sh
• bash -n scripts/wait_for_ib_gateway_ready.sh scripts/recover_ib_gateway_ready.sh scripts/restart_ib_gateway_daily.sh scripts/install_gateway_health_watcher.sh scripts/install_2fa_bot_watcher.sh

Operational note

I also installed the new watcher timers on the current Gateway VM and verified the live IB API handshake succeeds against the running container.