[WIP] Audit Hyperion codebase for bugs, performance, and security issues

[Copilot]

• Audit codebase — findings categorized by severity
• P0 Security — Path traversal via ticker in server.py file paths (S-1): validate ticker against ^[A-Z0-9.\-]{1,10}$ and assert resolved path stays inside results/
• P0 Security — debug=True on public-facing Flask server (S-2): debug now reads from FLASK_DEBUG env var, defaults to false
• P0 Bug — UnboundLocalError when walk-forward fallback triggers (B-1): initialise wf_results = {} in the except branch
• P1 Bug — pred_len ignores min_len causing potential misalignment in simulate() (B-3): pred_len = min_len
• P1 Bug — doji() divide-by-zero when high == low (B-4): use .replace(0, np.nan) in denominator
• P1 Bug — Race condition + missing error handling in _get_stock_info() (B-5): hold _lock during check-and-set; catch fetch errors and store empty dict
• P1 Code quality — optimizer.py bypasses logger singleton; blanket warnings.filterwarnings("ignore") (CQ-3): import from src.util import logger; replace blanket suppression with targeted filters
• P2 Code quality — print() calls in stacked_pipeline.py and ranker.py → logger.*() (CQ-1); ranking table consolidated into a single logger.info call to reduce log noise
• P2 Code quality — traceback.print_exc() calls → logger.exception() in base_pipeline.py, stacked_pipeline.py, time_series_stacked_pipeline.py (CQ-2); removed now-unused import traceback