fix(settings): paper_mode in UserResponse + bot_engine required fields + test sync

schemas.py:
- Add paper_mode: bool = False to UserResponse so frontend can distinguish
  paper vs live subscribers and skip HL API key requirement accordingly

api/user.py:
- Return paper_mode=bool(sub.paper_mode) in GET /user/{wallet}
- Fix elif-chain bug in settings validation: two independent `if` blocks
  instead of elif so both TP and SL ranges are checked when trump_enabled
- Conditional validation: TP/SL required only when trump_enabled=True;
  daily_budget_usd optional at all times
- Persist trump_enabled / macro_enabled from PUT /user/{wallet}/settings

services/bot_engine.py:
- Remove daily_budget_usd from required fields check — it is optional
  (null = no cap). Previous code silently skipped ALL trades for users
  who cleared their daily budget cap.

alembic/versions/025_module_toggles.py:
- Add trump_enabled, macro_enabled columns to subscriptions table

tests/test_production_readiness.py:
- Sync test_open_positions_requires_signed_wallet_read to patch
  verify_signed_request_any (the function now used) instead of
  verify_signed_request; update expected call kwargs accordingly

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

tests/test_production_readiness.py

@@ -83,7 +83,9 @@ async def test_open_positions_requires_signed_wallet_read(monkeypatch):
     def fake_verify(**kwargs):
         calls.append(kwargs)
 
-    monkeypatch.setattr(positions, "verify_signed_request", fake_verify)
+    # get_open_positions now uses verify_signed_request_any (accepts either
+    # view_positions or view_user action), so patch that instead.
+    monkeypatch.setattr(positions, "verify_signed_request_any", fake_verify)
     db = _Db([[]])
 
     result = await positions.get_open_positions(
@@ -95,7 +97,7 @@ async def test_open_positions_requires_signed_wallet_read(monkeypatch):
 
     assert result.wallet == "0xabc"
     assert calls == [{
-        "action": positions.ACTION_VIEW_POSITIONS,
+        "actions": [positions.ACTION_VIEW_POSITIONS, positions.ACTION_VIEW_USER],
         "wallet": "0xabc",
         "timestamp_ms": 123,
         "signature": "0xsig",