fix(safety): force Auto-Trade OFF on paper→live promotion

Money-safety bug: subscribe() changed paper_mode on a paper→live promotion
but left auto_trade untouched. A user could flip Auto-Trade ON while in paper
mode (harmless — SystemControl only checks 'subscribed', not paper), then
promote to live and add an API key — at which point the next high-confidence
Trump signal opens a REAL position, carried over from a switch they flipped
when it cost nothing.

Now: when paper_mode transitions True→False AND auto_trade is on, force
auto_trade=False. The user must re-enable it explicitly while live (a signed,
intentional action). Risk-raising transition resets the dangerous switch —
standard financial-product safety. Frontend handleUpgradeToLive copy updated
to say Auto-Trade is turned off on the switch.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/subscribe.py

@@ -63,6 +63,18 @@ async def subscribe(request: Request, db: AsyncSession = Depends(get_db)):
         # Re-subscribing is allowed to change paper mode (e.g. user wants to
         # promote from paper to live). Otherwise leave existing flag alone.
         if paper_mode != sub.paper_mode:
+            # SAFETY: promoting paper → live raises the risk level from
+            # "simulated" to "real money". Force Auto-Trade OFF on that
+            # transition so a switch the user flipped while it was harmless
+            # (paper) can NEVER carry over and silently start opening real
+            # positions the moment they add an API key. They must re-enable
+            # Auto-Trade explicitly while live — an intentional, signed action.
+            if sub.paper_mode and not paper_mode and sub.auto_trade:
+                sub.auto_trade = False
+                logger.info(
+                    "Subscription %s promoted paper→live — Auto-Trade forced "
+                    "OFF (must be re-enabled explicitly while live)", wallet,
+                )
             sub.paper_mode = paper_mode
 
     await db.commit()