fix: pre-launch hardening — HYPE price feed, KOL wallet cleanup, Telegram Trump alert, rate limiting, brittle test

Batch of the pre-launch audit campaign (BUG-01…14 plus three new features):

Pricing / TP-SL protection
- Add app/services/hl_price_feed.py: supplemental HL allMids poller for
  HL-native assets (HYPE, PURR) not listed on Binance. Pumps price_store +
  tp_sl_monitor.on_price_tick so bot trades on these assets keep full
  stop-loss / take-profit / trailing protection instead of max-hold only.
- Wire feed into main.py lifespan (startup task + graceful shutdown cancel).

Telegram
- Add format_trump_mention + PATH B in _dispatch: crypto-relevant Trump
  posts with no directional signal (relevant=True, signal=hold) now alert
  the public channel only (no per-subscriber noise).
- Rate limiter (slowapi) on the API; assorted bot/digest fixes.

KOL on-chain
- seed_kol_wallets.py: KOL_FEEDS coverage cross-check; reversibly deactivate
  orphaned wallets (handle not in KOL_FEEDS → can never produce divergence)
  so the scanner stops burning cycles on them.

Tests / misc
- Fix brittle test_macro_ahr999_uses_same_formula_as_scanner: mock now uses
  realistic ms timestamps so the in-progress-day drop fires, matching the
  fetcher's bar count (was 0.3179 vs 0.3178 off-by-one).
- Refresh stale notify_signal comment in truth_social.py.

Frontend reduce-action type fix lives in the sibling repo.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/api/positions.py

@@ -35,7 +35,7 @@ from app.database import get_db
 from app.models import BotTrade, Subscription, iso_utc
 from app.services.crypto import decrypt_api_key
 from app.services.price_store import price_store
-from app.services.signed_request import verify_signed_request
+from app.services.signed_request import verify_signed_request, verify_signed_request_any
 
 router = APIRouter()
 logger = logging.getLogger(__name__)
@@ -150,8 +150,8 @@ async def get_open_positions(
 ):
     """Live open positions for the wallet, with mark-to-market PnL."""
     wallet = wallet.lower().strip()
-    verify_signed_request(
-        action=ACTION_VIEW_POSITIONS,
+    verify_signed_request_any(
+        actions=[ACTION_VIEW_POSITIONS, ACTION_VIEW_USER],
         wallet=wallet,
         timestamp_ms=ts,
         signature=sig,
@@ -187,8 +187,8 @@ async def get_today_stats(
     one-shot count for opens.
     """
     wallet = wallet.lower().strip()
-    verify_signed_request(
-        action=ACTION_VIEW_POSITIONS,
+    verify_signed_request_any(
+        actions=[ACTION_VIEW_POSITIONS, ACTION_VIEW_USER],
         wallet=wallet,
         timestamp_ms=ts,
         signature=sig,
@@ -242,6 +242,7 @@ async def get_today_stats(
 ACTION_CLOSE_TRADE = "close_trade"
 ACTION_SET_GROW    = "set_trade_grow"
 ACTION_VIEW_POSITIONS = "view_positions"
+ACTION_VIEW_USER      = "view_user"
 ACTION_ADOPT_POSITION = "adopt_position"
 ACTION_RELEASE_TRADE  = "release_trade"