fix(settings): paper_mode in UserResponse + bot_engine required fields + test sync

schemas.py:
- Add paper_mode: bool = False to UserResponse so frontend can distinguish
  paper vs live subscribers and skip HL API key requirement accordingly

api/user.py:
- Return paper_mode=bool(sub.paper_mode) in GET /user/{wallet}
- Fix elif-chain bug in settings validation: two independent `if` blocks
  instead of elif so both TP and SL ranges are checked when trump_enabled
- Conditional validation: TP/SL required only when trump_enabled=True;
  daily_budget_usd optional at all times
- Persist trump_enabled / macro_enabled from PUT /user/{wallet}/settings

services/bot_engine.py:
- Remove daily_budget_usd from required fields check — it is optional
  (null = no cap). Previous code silently skipped ALL trades for users
  who cleared their daily budget cap.

alembic/versions/025_module_toggles.py:
- Add trump_enabled, macro_enabled columns to subscriptions table

tests/test_production_readiness.py:
- Sync test_open_positions_requires_signed_wallet_read to patch
  verify_signed_request_any (the function now used) instead of
  verify_signed_request; update expected call kwargs accordingly

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

app/api/user.py

@@ -171,6 +171,7 @@ async def get_user(
         subscribed_at=iso_utc(sub.subscribed_at),
         hl_api_key_set=hl_api_key_set,
         hl_api_key_masked=masked,
+        paper_mode=bool(sub.paper_mode),
         trades=[_trade_to_schema(t) for t in trades],
         settings=UserSettings(
             leverage=sub.leverage,
@@ -183,6 +184,8 @@ async def get_user(
             sys2_mode=sub.sys2_mode,
             active_from=iso_utc(sub.active_from),
             active_until=iso_utc(sub.active_until),
+            trump_enabled=sub.trump_enabled,
+            macro_enabled=sub.macro_enabled,
         ),
         manual_window_until=iso_utc(sub.manual_window_until),
     )
@@ -213,20 +216,25 @@ async def set_user_settings(
         raise HTTPException(422, "leverage must be 1–50")
     if not (5 <= s.position_size_usd <= 10000):
         raise HTTPException(422, "position_size_usd must be $5–$10,000")
-    # Take-profit, stop-loss and daily budget are now MANDATORY — the bot won't
-    # run without them, so we reject null here and force the client to supply values.
-    if s.take_profit_pct is None or not (0.1 <= s.take_profit_pct <= 50):
-        raise HTTPException(422, "take_profit_pct is required (0.1–50)")
-    if s.stop_loss_pct is None or not (0.1 <= s.stop_loss_pct <= 50):
-        raise HTTPException(422, "stop_loss_pct is required (0.1–50)")
+    # TP/SL required only when Trump module is enabled.
+    if s.trump_enabled:
+        if s.take_profit_pct is None or not (0.1 <= s.take_profit_pct <= 50):
+            raise HTTPException(422, "take_profit_pct is required when trump_enabled (0.1–50)")
+        if s.stop_loss_pct is None or not (0.1 <= s.stop_loss_pct <= 50):
+            raise HTTPException(422, "stop_loss_pct is required when trump_enabled (0.1–50)")
+    else:
+        if s.take_profit_pct is not None and not (0.1 <= s.take_profit_pct <= 50):
+            raise HTTPException(422, "take_profit_pct must be 0.1–50 if provided")
+        if s.stop_loss_pct is not None and not (0.1 <= s.stop_loss_pct <= 50):
+            raise HTTPException(422, "stop_loss_pct must be 0.1–50 if provided")
     if not (0 <= s.min_confidence <= 100):
         raise HTTPException(422, "min_confidence must be 0–100")
     if s.sys2_leverage is not None and not (1 <= s.sys2_leverage <= 10):
         raise HTTPException(422, "sys2_leverage must be 1–10")
     if s.sys2_mode is not None and s.sys2_mode not in ("standard", "aggressive"):
         raise HTTPException(422, "sys2_mode must be 'standard' or 'aggressive'")
-    if s.daily_budget_usd is None or not (0 < s.daily_budget_usd <= 100000):
-        raise HTTPException(422, "daily_budget_usd is required (>0, ≤100,000)")
+    if s.daily_budget_usd is not None and not (0 < s.daily_budget_usd <= 100000):
+        raise HTTPException(422, "daily_budget_usd must be >0 and ≤100,000 if provided")
 
     # Parse schedule (ISO strings → naive-UTC datetimes). Either both or neither.
     from datetime import datetime as _dt, timezone as _tz
@@ -275,6 +283,10 @@ async def set_user_settings(
         sub.sys2_mode = s.sys2_mode
     sub.active_from = af
     sub.active_until = au
+    if s.trump_enabled is not None:
+        sub.trump_enabled = s.trump_enabled
+    if s.macro_enabled is not None:
+        sub.macro_enabled = s.macro_enabled
     await db.commit()
     logger.info("Settings updated for %s: %s", wallet, s.model_dump())
     return s