Lean default response + symbol aliases

The default /v1/spot/{symbol} and /v1/prices response is now a lean 9-field core: symbol, quote_currency, unit, contract_type, price, bid, ask, is_stale, computed_at. Provenance, karat grams, and OHLC/stats are opt-in via ?include=sources|karat|stats|all (comma-separable; unknown tokens ignored). Symbol aliases now resolve before the tier gate: gold/XAU, silver/XAG, copper/HG, and bare base-quote such as XAU-USD all map to their canonical symbol, without bypassing tier access. Anonymous and authenticated callers share the same lean default; request ?include=all for the previous full shape.