compliance: flag-gate AI portfolio + cloud sync + Stripe; de-risk prompts; harden reviewer

Implements docs/read-markets-compliance-changes.md as flag-gated changes
(no deletions) so paused features stay in the tree for future re-enable.
All four flags default False so a fresh deploy is compliance-safe.

- New env flags: PORTFOLIO_AI_ENABLED, PORTFOLIO_SYNC_ENABLED,
  TICKER_UNIVERSE_AGGREGATE_ENABLED, SUBSCRIPTIONS_ENABLED.
- Gates: /api/analyze, /api/portfolio/sync*, /api/stripe/*, /pricing,
  ticker_universe writes, portfolio_analysis.analyse(). is_paid_active()
  returns True for any auth'd user when subscriptions are paused.
- Prompts (PROMPT_VERSION 10): universal _COMPLIANCE_RIDER prepended to
  every system prompt; watch list removed; price-target / close-above-below
  / trigger / forward-state-as-description rules added; SPECULATIVE
  pivoted to regime-only scenarios; daily + weekly digests tightened.
- Reviewer: deterministic regex/lexicon pre-check fail-closed under the
  Haiku call; portfolio rider gated by PORTFOLIO_AI_ENABLED; base prompt
  sharpened for forward-state and MAR forward-opinion patterns;
  ReviewerVerdict audit table; generate_with_review retry helper.
- Migration 0026: purge portfolio_sync + ticker_universe; create
  reviewer_verdicts.
- Copy: MAR cite fixed to Art 3(1)(35) + Art 20 + Del Reg 2016/958;
  portfolio reframed as browser-only viewer in disclaimer / privacy /
  terms / about / pricing / landing (en + it). TODO(legal) marker for
  lawyer sign-off on disclaimer.
- Tests: 13 lexicon + 6 reviewer compliance regressions; conftest enables
  all flags so existing 402 tests still cover their code paths.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

alembic/versions/0026_compliance_purge_and_audit.py

@@ -0,0 +1,75 @@
+"""compliance purge (portfolio_sync, ticker_universe) + reviewer_verdicts audit table.
+
+Revision ID: 0026
+Revises: 0025
+Create Date: 2026-05-29
+
+See docs/read-markets-compliance-changes.md.
+
+Two unrelated changes bundled into one migration because they ship together:
+
+1. Purge — the server learns nothing about anyone's holdings while the
+   compliance flags are off. Empties ``portfolio_sync`` (per-user encrypted
+   ciphertext blobs) and ``ticker_universe`` (the anonymous aggregate set of
+   tickers ever uploaded). Tables stay; data goes. If a flag is later
+   re-enabled, the tables refill from scratch.
+
+2. Audit — adds ``reviewer_verdicts`` so every output-reviewer decision
+   (deterministic + LLM, pass and fail) is persisted with surface, candidate
+   text, reason, layer, and model. This is the regulator-facing evidence that
+   automated review runs on every published item.
+
+Downgrade restores neither the purged data nor the historical verdicts —
+both are destructive; downgrade just drops the audit table.
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+
+revision: str = "0026"
+down_revision: Union[str, None] = "0025"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # 1. Purge — server holds no portfolio data.
+    op.execute("DELETE FROM portfolio_sync")
+    op.execute("DELETE FROM ticker_universe")
+
+    # 2. Audit trail for the two-layer output reviewer. Append-only.
+    op.create_table(
+        "reviewer_verdicts",
+        sa.Column("id", sa.BigInteger().with_variant(sa.Integer(), "sqlite"),
+                  primary_key=True, autoincrement=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False,
+                  server_default=sa.text("CURRENT_TIMESTAMP")),
+        sa.Column("surface", sa.String(length=32), nullable=True),
+        sa.Column("candidate_text", sa.Text(), nullable=False),
+        sa.Column("clean", sa.Boolean(), nullable=False),
+        sa.Column("reason", sa.String(length=255), nullable=True),
+        sa.Column("layer", sa.String(length=16), nullable=False),
+        sa.Column("model", sa.String(length=64), nullable=True),
+    )
+    op.create_index(
+        "ix_reviewer_verdicts_created_at",
+        "reviewer_verdicts", ["created_at"],
+    )
+    op.create_index(
+        "ix_reviewer_verdicts_surface",
+        "reviewer_verdicts", ["surface"],
+    )
+    op.create_index(
+        "ix_reviewer_verdicts_clean",
+        "reviewer_verdicts", ["clean"],
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_reviewer_verdicts_clean", table_name="reviewer_verdicts")
+    op.drop_index("ix_reviewer_verdicts_surface", table_name="reviewer_verdicts")
+    op.drop_index("ix_reviewer_verdicts_created_at", table_name="reviewer_verdicts")
+    op.drop_table("reviewer_verdicts")
+    # Purges are not restored on downgrade — the data is gone.