fix(stable_api): four correctness bugs — open_pending, sell_option, worker index collision, follow_candle spam

[AKIB473]

Problem

Four independent but related correctness bugs in stable_api.py, all discovered during a code review after PR #82. Each bug is documented in a dedicated issue.

---

Changes

1. open_pending — inverted while/else logic (closes #83)

Python's while/else runs the else block when the loop condition becomes False — i.e. when pending_id was never set (timeout or disconnect). The original code called instruments_follow() there, meaning:

• On success: instruments_follow was skipped entirely
• On failure/timeout: a duplicate order was sent — real money risk

Fix: replace while/else with an explicit if self.api.pending_id is not None check after the loop.

---

2. sell_option — race condition wipes WebSocket response (closes #84)

sold_options_respond was reset to None after the request was sent. On low-latency connections the WS response arrives before the reset line executes, gets silently overwritten, and the poll loop raises TimeoutError every time.

Fix: move the sentinel reset to before send — consistent with how candles_data and other sentinels are handled elsewhere in the codebase.

---

3. get_historical_candles — worker index collision (closes #85)

Workers computed:

index = int(time.time() * 1000) + worker_id

Two workers (or two iterations within the same worker) running in the same millisecond produce identical indices. The event registry keys responses on this index, so workers silently steal each other's data — wrong historical candles returned with no error raised.

Fix: a module-level itertools.count seeded from the current millisecond timestamp guarantees a globally unique index per request within the process.

---

4. start_candles_one_stream — follow_candle spam (closes #86)

follow_candle() (a WebSocket subscribe request) was called inside the 0.2 s polling loop, sending up to 100 subscribe messages for a single stream setup. This directly contradicts the README warning about excessive requests causing bans.

Fix: move the single subscribe call before the loop; the loop body now only polls candle_generated_check and sleeps.

---

Files Changed

File	Change
pyquotex/stable_api.py	4 targeted fixes, +29 / -9 lines

Impact / Risks

• No public API change — all method signatures and return types are unchanged
• All fixes are confined to stable_api.py
• Low risk — each change is a minimal, well-scoped correction
• Consistent with patterns already established in the codebase (sentinel-before-send, event-driven wait)