Add investment trade and holding support

[shrijayan]

Why

Sure's API already has full support for investment trades (/api/v1/trades) and holdings (/api/v1/holdings) — buying/selling stock, dividends, deposits/withdrawals, interest — but this MCP server only ever wrapped the generic cash /api/v1/transactions endpoint. There was no way to record a stock trade on an investment account through Claude/an MCP client; the only option (create_transaction) has no concept of ticker/quantity/price, so it can't represent a trade correctly.

What's added

7 new tools, following the exact same pattern already used by the transaction tools (get_client() / handle_response() / try-except-log-json.dumps):

Tool	Maps to
get_trades	GET /api/v1/trades (filters: account_id, account_ids, start_date, end_date, paginated)
get_trade	GET /api/v1/trades/:id
create_trade	POST /api/v1/trades — trade_type one of buy/sell/dividend/deposit/withdrawal/interest
update_trade	PATCH /api/v1/trades/:id
delete_trade	DELETE /api/v1/trades/:id
get_holdings	GET /api/v1/holdings (read-only — Sure computes these from trades + prices)
get_holding	GET /api/v1/holdings/:id

All endpoint paths, required params, and per-type validation rules were confirmed directly against Api::V1::TradesController / Api::V1::HoldingsController in we-promise/sure, not guessed.

Trade-type validation and per-type required-field rules (e.g. qty/price for buy/sell, amount for dividend/interest/deposit/withdrawal) are intentionally not duplicated client-side — same as the existing transaction tools, invalid input is left to the Sure API to reject with its own descriptive error message, so this stays in sync automatically if Sure's rules change.

Docs

README.md: added the new tools to the tools table, plus a short "Investment Trades" section documenting which fields are required per trade_type and the investment/crypto-exchange account requirement.

Testing

• get_trades / get_holdings (and their singular counterparts) were run live against a real self-hosted Sure instance with existing investment-account data and correctly returned real trades/holdings.
• Didn't run a live create/update/delete against real portfolio data to avoid touching real financial records during review; the write paths reuse the same request/response handling already proven by the existing create_transaction/update_transaction/delete_transaction tools, with parameters verified against the controller source (linked above).
• python -m py_compile and ruff check --select F,E9 pass on the new code (pre-existing lint/type debt elsewhere in the file — untyped @mcp.tool() decorators, missing mcp/httpx stubs, a few long log lines — is unrelated to this change and left as-is to keep the diff focused).

[shrijayan]

Superseded by we-promise#3 — opening this same change against we-promise/sure-mcp-server instead, since that's the actively maintained fork (already has Docker support merged, accepts community PRs). Closing this one to avoid duplicate effort.