fix(settings): paper_mode in UserResponse + bot_engine required fields + test sync

schemas.py:
- Add paper_mode: bool = False to UserResponse so frontend can distinguish
  paper vs live subscribers and skip HL API key requirement accordingly

api/user.py:
- Return paper_mode=bool(sub.paper_mode) in GET /user/{wallet}
- Fix elif-chain bug in settings validation: two independent `if` blocks
  instead of elif so both TP and SL ranges are checked when trump_enabled
- Conditional validation: TP/SL required only when trump_enabled=True;
  daily_budget_usd optional at all times
- Persist trump_enabled / macro_enabled from PUT /user/{wallet}/settings

services/bot_engine.py:
- Remove daily_budget_usd from required fields check — it is optional
  (null = no cap). Previous code silently skipped ALL trades for users
  who cleared their daily budget cap.

alembic/versions/025_module_toggles.py:
- Add trump_enabled, macro_enabled columns to subscriptions table

tests/test_production_readiness.py:
- Sync test_open_positions_requires_signed_wallet_read to patch
  verify_signed_request_any (the function now used) instead of
  verify_signed_request; update expected call kwargs accordingly

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

app/services/bot_engine.py

@@ -302,19 +302,17 @@ async def _execute_for_subscriber(
     if not sub["hl_api_key"]:
         logger.warning("Subscriber %s has no HL API key, skipping", wallet)
         return
-    # Required-setup guard. System 1 (Trump) needs the user's take-profit,
-    # stop-loss, and daily budget. System 2 (reversal) supplies its own
-    # stop-loss + (no) take-profit from the category profile — only the
-    # daily budget remains a user-required risk cap there.
-    if sub.get("_is_system_2"):
-        required = ("daily_budget_usd",)
-    else:
-        required = ("take_profit_pct", "stop_loss_pct", "daily_budget_usd")
-    missing = [k for k in required if sub.get(k) is None]
-    if missing:
-        logger.info("Sub %s skipped post %d: setup incomplete (missing %s)",
-                    wallet, post_id, ", ".join(missing))
-        return
+    # Required-setup guard. System 1 (Trump) needs take-profit and stop-loss.
+    # System 2 (reversal) supplies its own stop + trailing from the category
+    # profile, so only the two Trump exit fields are user-required.
+    # daily_budget_usd is OPTIONAL — null means no cap, not misconfigured.
+    if not sub.get("_is_system_2"):
+        required = ("take_profit_pct", "stop_loss_pct")
+        missing = [k for k in required if sub.get(k) is None]
+        if missing:
+            logger.info("Sub %s skipped post %d: setup incomplete (missing %s)",
+                        wallet, post_id, ", ".join(missing))
+            return
 
     confidence_floor = _confidence_floor_for(sub)
     if post_confidence < confidence_floor: