compliance: flag-gate AI portfolio + cloud sync + Stripe; de-risk prompts; harden reviewer

Implements docs/read-markets-compliance-changes.md as flag-gated changes
(no deletions) so paused features stay in the tree for future re-enable.
All four flags default False so a fresh deploy is compliance-safe.

- New env flags: PORTFOLIO_AI_ENABLED, PORTFOLIO_SYNC_ENABLED,
  TICKER_UNIVERSE_AGGREGATE_ENABLED, SUBSCRIPTIONS_ENABLED.
- Gates: /api/analyze, /api/portfolio/sync*, /api/stripe/*, /pricing,
  ticker_universe writes, portfolio_analysis.analyse(). is_paid_active()
  returns True for any auth'd user when subscriptions are paused.
- Prompts (PROMPT_VERSION 10): universal _COMPLIANCE_RIDER prepended to
  every system prompt; watch list removed; price-target / close-above-below
  / trigger / forward-state-as-description rules added; SPECULATIVE
  pivoted to regime-only scenarios; daily + weekly digests tightened.
- Reviewer: deterministic regex/lexicon pre-check fail-closed under the
  Haiku call; portfolio rider gated by PORTFOLIO_AI_ENABLED; base prompt
  sharpened for forward-state and MAR forward-opinion patterns;
  ReviewerVerdict audit table; generate_with_review retry helper.
- Migration 0026: purge portfolio_sync + ticker_universe; create
  reviewer_verdicts.
- Copy: MAR cite fixed to Art 3(1)(35) + Art 20 + Del Reg 2016/958;
  portfolio reframed as browser-only viewer in disclaimer / privacy /
  terms / about / pricing / landing (en + it). TODO(legal) marker for
  lawyer sign-off on disclaimer.
- Tests: 13 lexicon + 6 reviewer compliance regressions; conftest enables
  all flags so existing 402 tests still cover their code paths.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/config.py

@@ -105,6 +105,25 @@ class Settings(BaseSettings):
     STRIPE_PRICE_MONTHLY: str = ""   # price_xxx for £7/month subscription
     STRIPE_PRICE_ANNUAL: str = ""    # price_xxx for £70/year subscription
 
+    # Compliance feature flags. All default False so a fresh deploy is on the
+    # compliance-safe side. Code paths stay in the tree — flip a flag to
+    # reactivate. See docs/read-markets-compliance-changes.md.
+    #
+    # PORTFOLIO_AI_ENABLED — gates /api/analyze, portfolio_analysis.analyse(),
+    #   the AI-read UI on the dashboard, and the output-reviewer portfolio rider.
+    # PORTFOLIO_SYNC_ENABLED — gates /api/portfolio/sync* routes, portfolio_sync
+    #   service, the cloud-sync UI/JS, and PortfolioSync writes.
+    # TICKER_UNIVERSE_AGGREGATE_ENABLED — gates server-side per-ticker aggregate
+    #   union writes (ticker_universe.buffer/flush/upsert). When off, the server
+    #   learns nothing about what anyone holds.
+    # SUBSCRIPTIONS_ENABLED — gates Stripe checkout/webhook/portal, the /pricing
+    #   page, and is_paid_active(). When off, is_paid_active() returns True for
+    #   every logged-in user (free-for-all while subscriptions are paused).
+    PORTFOLIO_AI_ENABLED: bool = False
+    PORTFOLIO_SYNC_ENABLED: bool = False
+    TICKER_UNIVERSE_AGGREGATE_ENABLED: bool = False
+    SUBSCRIPTIONS_ENABLED: bool = False
+
     # Config file locations (overridable for tests)
     BASELINE_TOML: Path = Field(default_factory=lambda: CONFIG_DIR / "default.toml")
     PORTFOLIO_TOML: Path = Field(default_factory=lambda: CONFIG_DIR / "portfolio.toml")