fix: pre-launch hardening — HYPE price feed, KOL wallet cleanup, Telegram Trump alert, rate limiting, brittle test

Batch of the pre-launch audit campaign (BUG-01…14 plus three new features):

Pricing / TP-SL protection
- Add app/services/hl_price_feed.py: supplemental HL allMids poller for
  HL-native assets (HYPE, PURR) not listed on Binance. Pumps price_store +
  tp_sl_monitor.on_price_tick so bot trades on these assets keep full
  stop-loss / take-profit / trailing protection instead of max-hold only.
- Wire feed into main.py lifespan (startup task + graceful shutdown cancel).

Telegram
- Add format_trump_mention + PATH B in _dispatch: crypto-relevant Trump
  posts with no directional signal (relevant=True, signal=hold) now alert
  the public channel only (no per-subscriber noise).
- Rate limiter (slowapi) on the API; assorted bot/digest fixes.

KOL on-chain
- seed_kol_wallets.py: KOL_FEEDS coverage cross-check; reversibly deactivate
  orphaned wallets (handle not in KOL_FEEDS → can never produce divergence)
  so the scanner stops burning cycles on them.

Tests / misc
- Fix brittle test_macro_ahr999_uses_same_formula_as_scanner: mock now uses
  realistic ms timestamps so the in-progress-day drop fires, matching the
  fetcher's bar count (was 0.3179 vs 0.3178 off-by-one).
- Refresh stale notify_signal comment in truth_social.py.

Frontend reduce-action type fix lives in the sibling repo.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/config.py

@@ -6,10 +6,10 @@ class Settings(BaseSettings):
     frontend_url: str = "http://localhost:3001"
     truth_social_rss: str = "https://truthsocial.com/@realDonaldTrump.rss"
     truth_social_poll_seconds: int = 15
-    binance_ws_url: str = (
-        "wss://data-stream.binance.vision/stream"
-        "?streams=btcusdt@kline_1m/ethusdt@kline_1m"
-    )
+    # WS URL is now built programmatically in binance.py from ASSET_MAP so the
+    # stream list and the routing table are always in sync. This setting is kept
+    # for external callers that still reference it; binance.py ignores it.
+    binance_ws_url: str = "wss://data-stream.binance.vision/stream"  # base only
     binance_rest_url: str = "https://data-api.binance.vision"
     environment: str = "production"
     ai_api_key: str = ""
@@ -38,6 +38,9 @@ class Settings(BaseSettings):
     # in the X-Ingest-Key header. Empty (default) = ingest endpoint is REJECTED
     # entirely until a key is configured (fail-closed).
     ingest_api_key: str = ""
+    # Base URL for internal signal ingest (used by scanners). In Docker, set to
+    # the service name (e.g. http://api:8000); bare-metal defaults to localhost.
+    ingest_base_url: str = "http://localhost:8000"
 
     # Glassnode on-chain data. Used only by the BTC bottom-reversal state
     # machine (MVRV-Z + STH-SOPR). Empty = scanner logs and skips fail-closed.
@@ -56,6 +59,10 @@ class Settings(BaseSettings):
     # Bot username (no @) — used by the Settings UI to render the deep link
     # t.me/<username>?start=<code>. Example: "trumpalpha_bot".
     telegram_bot_username: str = ""
+    # Public broadcast channel chat_id (e.g. "-1001234567890" or "@trumpalpha").
+    # When set, every actionable signal is also posted here in sanitised form
+    # (no trading details, no /adopt CTA). Leave empty to disable.
+    telegram_public_channel_id: str = ""
 
     model_config = {"env_file": ".env", "env_file_encoding": "utf-8", "extra": "ignore"}