[feature] mock UTA: persist in-memory pending commits & positions so restarts don't wipe staged trades

[futurehome]

Feature request: mock paper-trading must survive host restarts

Title (建议):
[feature] mock UTA: persist in-memory pending commits & positions so restarts don't wipe staged trades

---

One-line ask

Make the mock paper-trading source (mock-simulator-*) persist its in-memory state (positions/fills and the pending "awaiting approval" commit) so a host crash/reboot does not wipe staged trades or reset holdings — and optionally replay the persisted ledger on startup.

Problem

The mock wallet's positions and pending (staged / awaitingApproval) are process memory only. Only an already-pushed (filled) ledger is written to disk at
~/.openalice/data/trading/<source>/commit.json.

Consequence on host crash/reboot:

• Un-approved staged commits disappear → the Web UI shows "nothing to approve".
• Holdings reset to empty / cash back to initial → portfolio loses all positions.
• A scheduled daily rebalance can lose its entire staging silently.

Real-world hits (this desk):

• 2026-08-31: runtime restart → mock holdings wiped (cash back to ¥1,000,000).
• 2026-09-01 21:07: host kernel crash (kdump captured a vmcore; journalctl shows a 13s kdump boot followed by a clean reboot). The 9/1 rebalance staging — pending commit f3a1d9ad, 12 buy / 8 sell / 8 hold — and all positions vanished with the process. Result: "today has nothing to approve."

Expected behavior

1. Persistent holdings — after a host restart, portfolio still shows the pre-crash positions.
2. Persistent pending — an un-approved staged commit survives a restart and can still be approved/pushed from the Web UI.
3. Optional startup replay — rebuild positions deterministically from the on-disk commit.json (which already records each order's contract / side / quantity / direction). Must be idempotent: skip if positions is already non-empty.
4. Be the display/fill layer on top of the durable file ledger (orders/*.json), never the source of truth that can evaporate.

Acceptance criteria

• After building positions and pushing, a host restart → portfolio shows the same holdings.
• With an un-approved pending commit, a restart → git status still shows awaitingApproval, and it can be approved + pushed.
• Startup replay is idempotent and does not double-fill.

Notes

• Only mock/sim behavior is affected; live accounts are safe (their holdings live at the broker).
• This is the prerequisite for using the mock desk as a realistic "paper live" rehearsal.
• mock-replay-restore.md sketches the replay approach — the ask here is to implement it server-side (in UTA), not as an external wrapper script.