compliance: flag-gate AI portfolio + cloud sync + Stripe; de-risk prompts; harden reviewer

Implements docs/read-markets-compliance-changes.md as flag-gated changes
(no deletions) so paused features stay in the tree for future re-enable.
All four flags default False so a fresh deploy is compliance-safe.

- New env flags: PORTFOLIO_AI_ENABLED, PORTFOLIO_SYNC_ENABLED,
  TICKER_UNIVERSE_AGGREGATE_ENABLED, SUBSCRIPTIONS_ENABLED.
- Gates: /api/analyze, /api/portfolio/sync*, /api/stripe/*, /pricing,
  ticker_universe writes, portfolio_analysis.analyse(). is_paid_active()
  returns True for any auth'd user when subscriptions are paused.
- Prompts (PROMPT_VERSION 10): universal _COMPLIANCE_RIDER prepended to
  every system prompt; watch list removed; price-target / close-above-below
  / trigger / forward-state-as-description rules added; SPECULATIVE
  pivoted to regime-only scenarios; daily + weekly digests tightened.
- Reviewer: deterministic regex/lexicon pre-check fail-closed under the
  Haiku call; portfolio rider gated by PORTFOLIO_AI_ENABLED; base prompt
  sharpened for forward-state and MAR forward-opinion patterns;
  ReviewerVerdict audit table; generate_with_review retry helper.
- Migration 0026: purge portfolio_sync + ticker_universe; create
  reviewer_verdicts.
- Copy: MAR cite fixed to Art 3(1)(35) + Art 20 + Del Reg 2016/958;
  portfolio reframed as browser-only viewer in disclaimer / privacy /
  terms / about / pricing / landing (en + it). TODO(legal) marker for
  lawyer sign-off on disclaimer.
- Tests: 13 lexicon + 6 reviewer compliance regressions; conftest enables
  all flags so existing 402 tests still cover their code paths.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/jobs/ai_log_job.py

@@ -206,7 +206,8 @@ async def run() -> None:
                 # that drifted past the generator's system prompt. Drop
                 # rejected variants; the API falls back to the previous
                 # clean StrategicLog row.
-                verdict = await review_read(client, result.content)
+                verdict = await review_read(client, result.content,
+                                            surface="log", session=session)
                 full_cost = (result.cost_usd or 0.0) + (verdict.cost_usd or 0.0)
                 if not verdict.clean:
                     session.add(AICall(

app/jobs/indicator_summary_job.py

@@ -184,7 +184,8 @@ async def _generate_one(
         ))
         return None
 
-    verdict = await review_read(client, candidate)
+    verdict = await review_read(client, candidate,
+                                surface="indicator", session=session)
     if not verdict.clean:
         # Reviewer caught scratchpad / meta-commentary / partial text
         # INSIDE the read field. Drop the candidate; the previous good
@@ -314,7 +315,10 @@ async def run() -> None:
                             cost_usd=result.cost_usd, status="leaked",
                         ))
                     else:
-                        verdict = await review_read(client, candidate)
+                        verdict = await review_read(
+                            client, candidate,
+                            surface="indicator_aggregate", session=session,
+                        )
                         full_cost = (result.cost_usd or 0.0) + (verdict.cost_usd or 0.0)
                         if not verdict.clean:
                             log.warning("ind_summary.agg_reviewer_rejected",