compliance: flag-gate AI portfolio + cloud sync + Stripe; de-risk prompts; harden reviewer

Implements docs/read-markets-compliance-changes.md as flag-gated changes
(no deletions) so paused features stay in the tree for future re-enable.
All four flags default False so a fresh deploy is compliance-safe.

- New env flags: PORTFOLIO_AI_ENABLED, PORTFOLIO_SYNC_ENABLED,
  TICKER_UNIVERSE_AGGREGATE_ENABLED, SUBSCRIPTIONS_ENABLED.
- Gates: /api/analyze, /api/portfolio/sync*, /api/stripe/*, /pricing,
  ticker_universe writes, portfolio_analysis.analyse(). is_paid_active()
  returns True for any auth'd user when subscriptions are paused.
- Prompts (PROMPT_VERSION 10): universal _COMPLIANCE_RIDER prepended to
  every system prompt; watch list removed; price-target / close-above-below
  / trigger / forward-state-as-description rules added; SPECULATIVE
  pivoted to regime-only scenarios; daily + weekly digests tightened.
- Reviewer: deterministic regex/lexicon pre-check fail-closed under the
  Haiku call; portfolio rider gated by PORTFOLIO_AI_ENABLED; base prompt
  sharpened for forward-state and MAR forward-opinion patterns;
  ReviewerVerdict audit table; generate_with_review retry helper.
- Migration 0026: purge portfolio_sync + ticker_universe; create
  reviewer_verdicts.
- Copy: MAR cite fixed to Art 3(1)(35) + Art 20 + Del Reg 2016/958;
  portfolio reframed as browser-only viewer in disclaimer / privacy /
  terms / about / pricing / landing (en + it). TODO(legal) marker for
  lawyer sign-off on disclaimer.
- Tests: 13 lexicon + 6 reviewer compliance regressions; conftest enables
  all flags so existing 402 tests still cover their code paths.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/models.py

@@ -220,6 +220,32 @@ class AICall(Base):
     error: Mapped[str | None] = mapped_column(String(512))
 
 
+class ReviewerVerdict(Base):
+    """Append-only audit log of every output-reviewer verdict.
+
+    Both layers (deterministic lexicon + LLM) write here, pass and fail.
+    'Here is a complete log showing fail-closed automated review on every
+    published item' is the regulator-facing answer; this table is what backs
+    that claim. See app/services/output_review.py."""
+    __tablename__ = "reviewer_verdicts"
+    id: Mapped[int] = mapped_column(_PK, primary_key=True, autoincrement=True)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), default=utcnow, index=True,
+    )
+    # Caller-supplied tag — "log", "indicator", "indicator_aggregate", "chat",
+    # "portfolio", "digest", or None for unattributed.
+    surface: Mapped[str | None] = mapped_column(String(32), index=True)
+    # The candidate text being reviewed. Truncated upstream to avoid pathological
+    # writes; Text type accepts whatever fits.
+    candidate_text: Mapped[str] = mapped_column(Text, nullable=False)
+    clean: Mapped[bool] = mapped_column(Boolean, nullable=False, index=True)
+    reason: Mapped[str | None] = mapped_column(String(255))
+    # Which layer fired: "deterministic" | "llm" | "error".
+    layer: Mapped[str] = mapped_column(String(16), nullable=False)
+    # LLM-layer model id, nullable for deterministic / error rows.
+    model: Mapped[str | None] = mapped_column(String(64))
+
+
 # Portfolio / PortfolioSnapshot / Position removed in Phase G —
 # holdings live in the browser, the server stores only the anonymous
 # ticker universe + public market data.