ibkr: use IBKR account number as the canonical Account.id

Bug: provider passed the WF UUID as Account.id. ensure_account looks up
existing accounts by (provider, providerAccountId=Account.id), so the
WF-UUID-as-providerAccountId would never match the manually-created
account (which has providerAccountId=U13279690), causing the pipeline
to create a duplicate WF account on every cron run.

Fix: Account.id is now the IBKR account number (U13279690) throughout.
The pipeline's _ensure_accounts() resolves it to the WF UUID via the
canonical (provider, providerAccountId) lookup; activities are remapped
before import. CLI no longer takes the WF UUID — derives it post-import
via a cheap idempotent ensure_account call for the reconciliation step.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

broker_sync/cli.py

@@ -240,7 +240,6 @@ def ibkr(
     ),
     ibkr_flex_token: str = typer.Option(..., envvar="IBKR_FLEX_TOKEN"),
     ibkr_flex_query_id: str = typer.Option(..., envvar="IBKR_FLEX_QUERY_ID"),
-    ibkr_account_id: str = typer.Option(..., envvar="IBKR_ACCOUNT_ID"),
     ibkr_account_id_upstream: str = typer.Option(..., envvar="IBKR_ACCOUNT_ID_UPSTREAM"),
     pushgateway_url: str = typer.Option(
         "http://prometheus-prometheus-pushgateway.monitoring:9091/metrics",
@@ -254,6 +253,10 @@ def ibkr(
     broker-sync Activities, pushes through the shared pipeline, then
     reconciles broker-reported OpenPositions against WF-computed quantities
     and publishes a Pushgateway drift metric.
+
+    The Wealthfolio account UUID is resolved via the pipeline's
+    ensure_account(provider="ibkr", providerAccountId=IBKR_ACCOUNT_ID_UPSTREAM)
+    lookup — no need to wire the UUID in as a separate env var.
     """
     import time
     from decimal import Decimal
@@ -278,7 +281,6 @@ def ibkr(
         provider = IBKRProvider(
             token=ibkr_flex_token,
             query_id=ibkr_flex_query_id,
-            wf_account_id=ibkr_account_id,
             upstream_account_id=ibkr_account_id_upstream,
         )
         dedup = SyncRecordStore(data / "sync.db")
@@ -291,8 +293,13 @@ def ibkr(
                 dedup=dedup,
             )
 
+            # Resolve WF UUID for reconciliation. ensure_account is idempotent
+            # and already ran inside sync_provider_to_wealthfolio; this is a
+            # cheap re-lookup that returns the same UUID.
+            wf_uuid = await sink.ensure_account(provider.accounts()[0])
+
             # Reconciliation: broker truth vs WF truth.
-            wf_qty = await sink.compute_position_qty(ibkr_account_id)
+            wf_qty = await sink.compute_position_qty(wf_uuid)
             drift_metrics: list[tuple[str, dict[str, str], float]] = []
             for symbol, broker_qty in provider.open_positions():
                 drift = broker_qty - wf_qty.get(symbol, Decimal(0))