fix: pre-launch hardening — HYPE price feed, KOL wallet cleanup, Telegram Trump alert, rate limiting, brittle test

Batch of the pre-launch audit campaign (BUG-01…14 plus three new features):

Pricing / TP-SL protection
- Add app/services/hl_price_feed.py: supplemental HL allMids poller for
  HL-native assets (HYPE, PURR) not listed on Binance. Pumps price_store +
  tp_sl_monitor.on_price_tick so bot trades on these assets keep full
  stop-loss / take-profit / trailing protection instead of max-hold only.
- Wire feed into main.py lifespan (startup task + graceful shutdown cancel).

Telegram
- Add format_trump_mention + PATH B in _dispatch: crypto-relevant Trump
  posts with no directional signal (relevant=True, signal=hold) now alert
  the public channel only (no per-subscriber noise).
- Rate limiter (slowapi) on the API; assorted bot/digest fixes.

KOL on-chain
- seed_kol_wallets.py: KOL_FEEDS coverage cross-check; reversibly deactivate
  orphaned wallets (handle not in KOL_FEEDS → can never produce divergence)
  so the scanner stops burning cycles on them.

Tests / misc
- Fix brittle test_macro_ahr999_uses_same_formula_as_scanner: mock now uses
  realistic ms timestamps so the in-progress-day drop fires, matching the
  fetcher's bar count (was 0.3179 vs 0.3178 off-by-one).
- Refresh stale notify_signal comment in truth_social.py.

Frontend reduce-action type fix lives in the sibling repo.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/api/posts.py

@@ -1,7 +1,12 @@
 import logging
 from typing import List, Optional
 
-from fastapi import APIRouter, Depends, HTTPException, Query
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from fastapi.responses import Response
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+
+limiter = Limiter(key_func=get_remote_address)
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -66,16 +71,24 @@ def _post_to_schema(post: Post) -> TrumpPost:
 
 
 @router.get("/posts", response_model=List[TrumpPost])
+@limiter.limit("60/minute")
 async def get_posts(
+    request: Request,
     limit: int = Query(default=20, ge=1, le=500),
     page: int = Query(default=1, ge=1),
     db: AsyncSession = Depends(get_db),
+    response: Response = None,
 ):
     offset = (page - 1) * limit
     result = await db.execute(
         select(Post).order_by(Post.published_at.desc()).offset(offset).limit(limit)
     )
     posts = result.scalars().all()
+    # Posts are scraped every 5s but rarely change once written — allow CDN/browser
+    # to cache for 30s. stale-while-revalidate=60 means stale content is served
+    # while a fresh fetch happens in the background (no loading flash).
+    if response is not None:
+        response.headers["Cache-Control"] = "public, max-age=30, stale-while-revalidate=60"
     return [_post_to_schema(p) for p in posts]