compliance: flag-gate AI portfolio + cloud sync + Stripe; de-risk prompts; harden reviewer

Implements docs/read-markets-compliance-changes.md as flag-gated changes
(no deletions) so paused features stay in the tree for future re-enable.
All four flags default False so a fresh deploy is compliance-safe.

- New env flags: PORTFOLIO_AI_ENABLED, PORTFOLIO_SYNC_ENABLED,
  TICKER_UNIVERSE_AGGREGATE_ENABLED, SUBSCRIPTIONS_ENABLED.
- Gates: /api/analyze, /api/portfolio/sync*, /api/stripe/*, /pricing,
  ticker_universe writes, portfolio_analysis.analyse(). is_paid_active()
  returns True for any auth'd user when subscriptions are paused.
- Prompts (PROMPT_VERSION 10): universal _COMPLIANCE_RIDER prepended to
  every system prompt; watch list removed; price-target / close-above-below
  / trigger / forward-state-as-description rules added; SPECULATIVE
  pivoted to regime-only scenarios; daily + weekly digests tightened.
- Reviewer: deterministic regex/lexicon pre-check fail-closed under the
  Haiku call; portfolio rider gated by PORTFOLIO_AI_ENABLED; base prompt
  sharpened for forward-state and MAR forward-opinion patterns;
  ReviewerVerdict audit table; generate_with_review retry helper.
- Migration 0026: purge portfolio_sync + ticker_universe; create
  reviewer_verdicts.
- Copy: MAR cite fixed to Art 3(1)(35) + Art 20 + Del Reg 2016/958;
  portfolio reframed as browser-only viewer in disclaimer / privacy /
  terms / about / pricing / landing (en + it). TODO(legal) marker for
  lawyer sign-off on disclaimer.
- Tests: 13 lexicon + 6 reviewer compliance regressions; conftest enables
  all flags so existing 402 tests still cover their code paths.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/services/feature_flags.py

@@ -0,0 +1,41 @@
+"""Feature-flag gate helpers.
+
+The four compliance flags in ``app.config.Settings`` (``PORTFOLIO_AI_ENABLED``,
+``PORTFOLIO_SYNC_ENABLED``, ``TICKER_UNIVERSE_AGGREGATE_ENABLED``,
+``SUBSCRIPTIONS_ENABLED``) gate code paths that stay in the tree but are
+inactive by default. Routes / dependencies use ``require_flag()`` to 404 a
+whole endpoint when its flag is off — making the surface indistinguishable
+from a non-existent route.
+"""
+from __future__ import annotations
+
+from fastapi import HTTPException, status
+
+from app.config import get_settings
+
+
+def flag_enabled(flag_name: str) -> bool:
+    """Read a boolean flag from Settings. Unknown flags raise — typos here
+    would silently disable features otherwise."""
+    settings = get_settings()
+    if not hasattr(settings, flag_name):
+        raise AttributeError(f"unknown feature flag: {flag_name}")
+    return bool(getattr(settings, flag_name))
+
+
+def require_flag(flag_name: str):
+    """FastAPI dependency factory: 404 the route if the flag is off.
+
+    Usage::
+
+        @router.post("/analyze", dependencies=[Depends(require_flag("PORTFOLIO_AI_ENABLED"))])
+
+    404 (not 503) is deliberate: a paused feature should be indistinguishable
+    from a missing route to clients and crawlers."""
+    async def _gate() -> None:
+        if not flag_enabled(flag_name):
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="not found",
+            )
+    return _gate