feat(x): viral live-prediction X auto-poster for Trump signals

When Trump posts an actionable buy/short signal, instantly tweet the call
(entry/direction, hard time window, "ratio me" hook), then post a result
follow-up X_FOLLOWUP_MINUTES later reporting the realised 15-min move plus
a recent hit-rate brag with the site link.

- New app/services/x_poster.py: OAuth 1.0a signed (stdlib hmac, no new dep,
  httpx reused). Fire-and-forget, fully degradable — no-op unless X creds +
  x_enabled. Dry-run logs tweet text. In-memory UTC-daily cap. 280-char hard
  cap on all templates (no Premium).
- Gated to source=truth buy/short above x_min_confidence; scanner signals
  excluded (don't fit the "Trump just posted" format).
- Hooked next to notify_signal in /signals/ingest + both Trump pollers
  (dedup via unique external_id → single tweet per post).
- config.py + .env.example: X_API_KEY/SECRET, X_ACCESS_TOKEN/SECRET,
  X_ENABLED, X_MIN_CONFIDENCE, X_DAILY_CAP, X_FOLLOWUP_MINUTES, X_LINK_URL.

72 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -69,3 +69,24 @@ HL_MAINNET=true
 #               auto-runs create_all() on startup (Alembic bypass — DEV ONLY).
 # production  → both are off; schema strictly Alembic-managed.
 ENVIRONMENT=production
+
+# ── X (Twitter) auto-poster ───────────────────────────────────────────────────
+# Viral "live prediction" tweets: when Trump posts an actionable signal, the bot
+# tweets the call instantly, then posts a result follow-up X_FOLLOWUP_MINUTES later.
+# OAuth 1.0a User Context. From developer.x.com → your App → "Keys and tokens".
+#   ⚠️ App permissions MUST be "Read and Write" — then REGENERATE the access token.
+#   ⚠️ Do NOT use Bearer Token / Client ID / Client Secret (those are read/OAuth2).
+X_API_KEY=
+X_API_SECRET=
+X_ACCESS_TOKEN=
+X_ACCESS_SECRET=
+# Master switch. false = dry-run (logs tweet text, sends nothing) even with keys set.
+X_ENABLED=false
+# Only tweet when ai_confidence >= this (0–100).
+X_MIN_CONFIDENCE=60
+# Hard daily tweet cap (initial + follow-ups), resets at UTC midnight.
+X_DAILY_CAP=40
+# Minutes after the prediction tweet to post the result follow-up.
+X_FOLLOWUP_MINUTES=15
+# Public URL appended to the follow-up tweet (defaults to FRONTEND_URL if empty).
+X_LINK_URL=