Pre-launch hardening: KOL module, Telegram, scanners, WS resilience

Big-picture changes since b941223:

KOL pipeline (new) — Substack/podcast/blog RSS → AI ticker extraction →
on-chain wallet diff → talks-vs-trades divergence detection. Daily polls,
19 feeds, divergence emits Post + Telegram fan-out.

Telegram push (new) — walletless free tier + wallet-linked Pro upgrade,
in-bot preference commands (/trump /btc /funding /kol /conf /quiet),
signed-envelope API for dashboard. Disconnect-wallet keeps free
subscription.

BTC funding-rate reversal scanner (new) — hourly cron, 30d cumulative
funding threshold + mean-revert + 7d price confirm, emits via
/api/signals/ingest. BTC bottom-reversal scanner promoted to System 2.

WS broadcast rewrite — per-client send timeout + parallel fan-out
(asyncio.gather). Fixes "Binance WS no close frame" reconnect storms +
APScheduler 11-min job misses, both caused by one slow client stalling
the kline loop.

Error visibility — three silent-error sites (trumpstruth/truth_social
fetchers, funding_reversal scanner) now include exception type name so
httpx ConnectError-style empty-message errors stop logging blank lines.
Telegram bot loop now classifies ReadTimeout vs network vs unknown +
logger.exception for the unknown bucket.

Security hygiene — trumpsignal.db untracked from git (held subscriber
wallets + encrypted HL keys + 22 bot trades); .gitignore now blocks
*.db/.next/backups. CORS only allows FRONTEND_URL in production.

New ops scripts —
  - scripts/preflight.py: env/DB/Telegram/AI auth verification gate
  - scripts/backup_db.sh: cron-friendly daily DB backup (SQLite + Postgres)
  - scripts/seed_kol_wallets.py: idempotent KOL on-chain wallet seeder

15 new Alembic migrations (007-021) covering convex strategy fields,
phase-1 safety, two-system frozen exits, invalidation prices, dynamic
SYS2 leverage, staged de-risk + pyramiding, peak gain tracking, risk
mode, auto-trade + grow flags, KOL module, KOL on-chain, KOL divergence,
Telegram bindings + walletless.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -1,12 +1,14 @@
 # ── Database ─────────────────────────────────────────────────────────────────
-# For Docker Compose — only POSTGRES_PASSWORD needs to be set;
-# DATABASE_URL is built automatically by docker-compose.yml.
-# For local dev without Docker, set DATABASE_URL directly:
-# DATABASE_URL=sqlite+aiosqlite:///./trumpsignal.db
-POSTGRES_PASSWORD=change_me_in_production
+# Docker Compose reads SERVICE_* values and injects DATABASE_URL into the API
+# container. Bare-metal/systemd reads DATABASE_URL directly.
+SERVICE_USER_POSTGRES=trumpsignal
+SERVICE_PASSWORD_POSTGRES=change_me_in_production
+DATABASE_URL=postgresql+asyncpg://trumpsignal:change_me_in_production@localhost:5432/trumpsignal
 
 # ── CORS / Frontend ──────────────────────────────────────────────────────────
-# Your frontend origin — no trailing slash
+# Your frontend origin — no trailing slash. Used as the only allowed CORS
+# origin in production. Multiple origins not currently supported here; if
+# you need staging + prod simultaneously, edit app/main.py allowed_origins.
 FRONTEND_URL=https://yourdomain.com
 
 # ── Encryption ───────────────────────────────────────────────────────────────
@@ -15,14 +17,55 @@ FRONTEND_URL=https://yourdomain.com
 # WARNING: rotating this invalidates all stored keys.
 ENCRYPTION_KEY=
 
-# ── AI provider ──────────────────────────────────────────────────────────────
+# ── AI provider (System 1 / Trump analysis only) ────────────────────────────
+# OpenAI-compatible endpoint. DeepSeek used in dev.
 AI_API_KEY=
-AI_BASE_URL=https://api.gptsapi.net/v1
-AI_MODEL=claude-sonnet-4-6
+AI_BASE_URL=https://api.deepseek.com/v1
+AI_MODEL=deepseek-v4-pro          # batch / reanalysis (quality)
+AI_LIVE_MODEL=deepseek-v4-flash   # live post analysis (latency)
+# Optional: native Anthropic key takes priority over AI_API_KEY if set.
+# Used for KOL analysis (long-form essays) where reasoning > latency.
+ANTHROPIC_API_KEY=
 
-# ── Hyperliquid ──────────────────────────────────────────────────────────────
+# ── Signal ingest (System 2 scanners + external modules) ─────────────────────
+# Shared secret for POST /api/signals/ingest. Empty = endpoint disabled
+# (fail-closed). Generate: openssl rand -hex 32
+INGEST_API_KEY=
+
+# ── On-chain data providers ──────────────────────────────────────────────────
+# Glassnode — used by the BTC bottom-reversal scanner (MVRV-Z + STH-SOPR).
+# Free tier covers our query volume. Empty = scanner skips with a warning.
+# Sign up: https://glassnode.com → Account → API
+GLASSNODE_API_KEY=
+
+# Etherscan — used by KOL A-tier on-chain poller to read ERC-20 balances for
+# the wallets in `kol_wallets`. Free tier (5 req/s) is plenty for daily polls.
+# Empty = KOL on-chain snapshot pipeline skips Ethereum wallets (HL perps
+# still polled via Hyperliquid's free public API).
+# Sign up: https://etherscan.io/register → My API Keys
+ETHERSCAN_API_KEY=
+
+# ── Telegram push alerts ─────────────────────────────────────────────────────
+# Bot token from @BotFather (https://t.me/BotFather → /newbot). Free.
+# Empty = Telegram alerts disabled (bot loop skipped, notify_signal is a
+# no-op, /api/telegram endpoints return 503).
+TELEGRAM_BOT_TOKEN=
+# Bot username (no @) — used by the Settings UI to render the deep link
+# t.me/<username>?start=<code>. Example: trumpalpha_bot
+TELEGRAM_BOT_USERNAME=
+
+# ── Hyperliquid (server-side fallback only — most ops use user-provided keys) ─
+# These are ONLY for server-controlled signals (e.g. a dev/admin trade) — the
+# user-facing bot reads each subscriber's encrypted key from the DB instead.
+# Leave empty in production unless you're running a single-account demo.
+HL_API_PRIVATE_KEY=
+HL_ACCOUNT_ADDRESS=
+HL_LEVERAGE=3
 HL_MAINNET=true
 
 # ── Runtime ──────────────────────────────────────────────────────────────────
 # development | production
+# development → enables /api/dev/* endpoints (paper-mode toggle, etc.) AND
+#               auto-runs create_all() on startup (Alembic bypass — DEV ONLY).
+# production  → both are off; schema strictly Alembic-managed.
 ENVIRONMENT=production