[Niqnil]

Closes #803

What

The simulated venue can now liquidate its spot margin account. It is off by default, and a
configuration without it deserialises and behaves exactly as before.

SpotMarginConfig::with_liquidation(SpotMarginLiquidation::new(level, fee_rate)?) sets:

• a liquidation level: a margin level (what the account holds over what it owes, valued in
  the valuation asset), at least 1;
• a fee rate in [0, 1), charged on the value of the debt the liquidation repays.

SpotMarginLiquidation::with_margin_call(level) also adds a margin-call level above the
liquidation level.

When

After every input (advance_time and apply_market), last, the venue values the account the
same way the leverage limit does. The mid price is used, else the last price, of a spot pair with
the valuation asset. A margin call or liquidation is checked for at that point.

• At or below the liquidation level, the account is liquidated.
• With a margin-call level, NoticeKind::MarginCall is sent when the account falls to it and
  NoticeKind::MarginRestored when it rises back above it. Each is sent once per crossing. A
  liquidation ends a margin call without a MarginRestored.
• A debt the venue cannot value is not checked, with one warn! per venue. Collateral it cannot
  value counts as zero.

How a liquidation runs

1. An AccountNotice of NoticeKind::Liquidation, carrying the margin level.
2. Every open order is cancelled, resting or held, releasing what each held.
3. Each debt is repaid from that asset's own free balance.
4. The account's other assets are sold for what it owes of the valuation asset. They are sold in
   name order, and only as much as needed.
5. Each other asset owed is bought back with the valuation asset. If the buy costs more than the
   free valuation balance, other assets are sold first to cover the difference.
6. The fee is charged in the valuation asset, as a new CashFlowKind::LiquidationFee { rate, repaid }.
   If the free balance is short, more assets are sold first. A fee that still cannot be paid takes
   free below zero, with a warn!.

Each forced trade fills as a market order on arrival would, through the venue's fill model and
slippage, as a taker, and against the depth on offer. It is a Trade with
TradeOrigin::Liquidation, StrategyId::unknown(), no client order id and no order snapshot,
and it repays the debt of the asset it delivers.

A debt that one pass cannot close (thin depth, no market, too little left to sell) is left owed,
with one warn! per liquidation. The liquidation continues on every later input, without another
notice, until the account owes nothing.

While a liquidation is under way the venue lends nothing. An order that would need a loan is
rejected as unaffordable, its reason showing nothing borrowable, and a held order whose fill would
need one is cancelled. An order the account can pay for from its own balance is accepted, and
cancelled on the next input if it is still open. A debt the venue cannot trade out of keeps
lending off until the account repays it.

Configuration checks

with_liquidation returns a SpotMarginConfigError:

• LiquidationLevelBelowOne;
• LiquidationFeeOutOfRange;
• MarginCallNotAboveLiquidation;
• LiquidationWithinLeverage, for a level of L / (L − 1) or more for a maximum leverage L.
  An account borrowed to the limit is at that margin level, so the venue would liquidate an
  account for borrowing what it was allowed to.

CFD positions are not liquidated. The docs say so where CFD accounting is described.

Choices worth a look

• The fee is charged per pass, on what that pass repaid. A liquidation that closes in one pass
  is charged once. Each pass's fee comes out of what the account holds after that pass's
  repayments, selling for it as for the debt, as a venue takes its fee out of the proceeds of the
  liquidation's trades. So a debt a pass leaves owed has that much less to be repaid from.
• The debt repaid is measured after the cancels. A loan that a cancelled order gives back
  under auto-repay-at-cancel is not charged the fee.
• Collateral is sold for exactly what is needed, at the leg's price. Each division rounds, so
  the quantity is nudged by its last digit until the trade delivers all of what is needed without
  costing more than the account holds. If a quantity costs too much, the cap is lowered, so the
  nudge cannot climb back to it.
• A leg draws one slippage sample once priced. The sample is not handed back if the leg then
  trades nothing (for example, the book has no depth).
• A leg whose fee takes all it delivers is not traded. The debt is left owed, with the
  shortfall warning.

Also

• SimulatedVenue::borrowable now shares the account valuation (valued) with the liquidation
  check, so the two cannot drift apart.
• The TradeOrigin table, the AccountNotice producers list and the CashFlowKind producers list
  now include the simulated venue.

Tests

• exchange/mock/venue/tests/liquidation.rs, 25 tests:
  • a short bought back, and a long sold down;
  • cancels first, held and resting orders alike, in client order id order;
  • no lending while a liquidation is under way, to a limit order, a market order or a held
    order's fill;
  • a dust debt that values at zero;
  • margin call, restore, and once-per-crossing;
  • thin depth closed over later inputs, with distinct fee ids;
  • a debt too large to cover;
  • an unvalued debt, warned once;
  • a clock-driven liquidation;
  • a debt in a pair's quote;
  • a base-asset fee grossed up;
  • collateral sold in name order;
  • a buy-back that sells collateral first;
  • a fee that is partly covered;
  • the rounding nudge in both directions;
  • the quantity the fill model sees;
  • an unfed pair passed over;
  • a leg whose fee takes everything it delivers.
• Two configuration tests in margin.rs.
• rustrade/tests/test_sim_venue_spot_margin.rs: a liquidation fed through the indexer into
  EngineState leaves the position flat, and the engine's balances equal the venue's.