Pre-launch hardening: KOL module, Telegram, scanners, WS resilience

Big-picture changes since b941223:

KOL pipeline (new) — Substack/podcast/blog RSS → AI ticker extraction →
on-chain wallet diff → talks-vs-trades divergence detection. Daily polls,
19 feeds, divergence emits Post + Telegram fan-out.

Telegram push (new) — walletless free tier + wallet-linked Pro upgrade,
in-bot preference commands (/trump /btc /funding /kol /conf /quiet),
signed-envelope API for dashboard. Disconnect-wallet keeps free
subscription.

BTC funding-rate reversal scanner (new) — hourly cron, 30d cumulative
funding threshold + mean-revert + 7d price confirm, emits via
/api/signals/ingest. BTC bottom-reversal scanner promoted to System 2.

WS broadcast rewrite — per-client send timeout + parallel fan-out
(asyncio.gather). Fixes "Binance WS no close frame" reconnect storms +
APScheduler 11-min job misses, both caused by one slow client stalling
the kline loop.

Error visibility — three silent-error sites (trumpstruth/truth_social
fetchers, funding_reversal scanner) now include exception type name so
httpx ConnectError-style empty-message errors stop logging blank lines.
Telegram bot loop now classifies ReadTimeout vs network vs unknown +
logger.exception for the unknown bucket.

Security hygiene — trumpsignal.db untracked from git (held subscriber
wallets + encrypted HL keys + 22 bot trades); .gitignore now blocks
*.db/.next/backups. CORS only allows FRONTEND_URL in production.

New ops scripts —
  - scripts/preflight.py: env/DB/Telegram/AI auth verification gate
  - scripts/backup_db.sh: cron-friendly daily DB backup (SQLite + Postgres)
  - scripts/seed_kol_wallets.py: idempotent KOL on-chain wallet seeder

15 new Alembic migrations (007-021) covering convex strategy fields,
phase-1 safety, two-system frozen exits, invalidation prices, dynamic
SYS2 leverage, staged de-risk + pyramiding, peak gain tracking, risk
mode, auto-trade + grow flags, KOL module, KOL on-chain, KOL divergence,
Telegram bindings + walletless.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/schemas.py

@@ -37,6 +37,7 @@ class TrumpPost(BaseModel):
     target_asset: Optional[str] = None
     category: Optional[str] = None
     expected_move_pct: Optional[float] = None
+    invalidation_price: Optional[float] = None
 
     model_config = {"from_attributes": True}
 
@@ -61,6 +62,13 @@ class BotTrade(BaseModel):
     trigger_post_id: int
     opened_at: str
     closed_at: str
+    # Source tag of the originating signal (e.g. 'truth', 'breakout', 'my_strategy').
+    # Joined from posts.source on read; not stored on BotTrade itself.
+    # 'unknown' when the trigger post has been deleted or trigger_post_id is null.
+    trigger_source: Optional[str] = None
+    # True iff this was a paper trade (hl_order_id == 'paper'). Lets the UI
+    # tag the row so paper-mode P&L isn't mixed with real money in summaries.
+    is_paper: bool = False
 
     model_config = {"from_attributes": True}
 
@@ -87,12 +95,17 @@ class SignedEnvelope(BaseModel):
 
 
 class SubscribeRequest(SignedEnvelope):
-    pass
+    # Optional paper-mode flag. When true the bot writes simulated trades to
+    # the DB but never hits Hyperliquid — safe path for new users to try the
+    # system without risking funds. Defaults to false (live) for backwards
+    # compatibility with the existing signed-message format (body=None).
+    paper_mode: Optional[bool] = False
 
 
 class SubscribeResponse(BaseModel):
-    status: str
-    wallet: str
+    status:     str
+    wallet:     str
+    paper_mode: bool = False
 
 
 class SetApiKeyRequest(SignedEnvelope):
@@ -102,6 +115,7 @@ class SetApiKeyRequest(SignedEnvelope):
 class SetApiKeyResponse(BaseModel):
     status: str
     masked_key: str  # last 6 chars only, e.g. "...a1b2c3"
+    verified: bool = False
 
 
 class UserSettings(BaseModel):
@@ -111,6 +125,13 @@ class UserSettings(BaseModel):
     stop_loss_pct: Optional[float] = None
     min_confidence: int
     daily_budget_usd: Optional[float] = None
+    # System-2 (bottom reversal) leverage — independent of `leverage` (Trump).
+    # None → platform default (SYS2_DEFAULT_LEVERAGE). The protective stop is
+    # auto-scaled to this so the position is never exchange-liquidated.
+    sys2_leverage: Optional[int] = None
+    # System-2 risk mode: "standard" (default) or "aggressive" (separately
+    # funded high-risk/high-explosiveness sleeve). None → unchanged/standard.
+    sys2_mode: Optional[str] = None
     # ISO-8601 UTC strings; both None = always on (Subscription.active still gates it).
     active_from: Optional[str] = None
     active_until: Optional[str] = None
@@ -128,3 +149,6 @@ class UserResponse(BaseModel):
     hl_api_key_masked: Optional[str] = None
     trades: list[BotTrade]
     settings: UserSettings
+    # Convex-strategy: ISO-UTC timestamp until which the bot is manually armed.
+    # When null or in the past, the regular active_from/active_until schedule applies.
+    manual_window_until: Optional[str] = None