Create a bank securities program

Fresh verified non-API-key staff with ledger:securities:write required. Only bank-owned USD zero-coupon Treasury bills classified AFS, trade-date recognition and the explicit exact daily effective-yield convention are supported. The program binds bank legal entity, actual GL1010 and external master account identity, actual authority, broker/custodian agreements and signing keys. The reviewed dealer allowlist binds actual customer identity, external dealer reference, legal name and source evidence; it never substitutes for current independently reviewed nonaffiliate classification. No customer securities, deposits, HTM, funds, repos or certification are implied. All mutations require verified authority even in local mode; customers and API keys are refused. Evidence JSON is strict and bounded at 5 MiB; complete responses are bounded at 16 MiB and never silently truncated.