compliance: flag-gate AI portfolio + cloud sync + Stripe; de-risk prompts; harden reviewer

Implements docs/read-markets-compliance-changes.md as flag-gated changes
(no deletions) so paused features stay in the tree for future re-enable.
All four flags default False so a fresh deploy is compliance-safe.

- New env flags: PORTFOLIO_AI_ENABLED, PORTFOLIO_SYNC_ENABLED,
  TICKER_UNIVERSE_AGGREGATE_ENABLED, SUBSCRIPTIONS_ENABLED.
- Gates: /api/analyze, /api/portfolio/sync*, /api/stripe/*, /pricing,
  ticker_universe writes, portfolio_analysis.analyse(). is_paid_active()
  returns True for any auth'd user when subscriptions are paused.
- Prompts (PROMPT_VERSION 10): universal _COMPLIANCE_RIDER prepended to
  every system prompt; watch list removed; price-target / close-above-below
  / trigger / forward-state-as-description rules added; SPECULATIVE
  pivoted to regime-only scenarios; daily + weekly digests tightened.
- Reviewer: deterministic regex/lexicon pre-check fail-closed under the
  Haiku call; portfolio rider gated by PORTFOLIO_AI_ENABLED; base prompt
  sharpened for forward-state and MAR forward-opinion patterns;
  ReviewerVerdict audit table; generate_with_review retry helper.
- Migration 0026: purge portfolio_sync + ticker_universe; create
  reviewer_verdicts.
- Copy: MAR cite fixed to Art 3(1)(35) + Art 20 + Del Reg 2016/958;
  portfolio reframed as browser-only viewer in disclaimer / privacy /
  terms / about / pricing / landing (en + it). TODO(legal) marker for
  lawyer sign-off on disclaimer.
- Tests: 13 lexicon + 6 reviewer compliance regressions; conftest enables
  all flags so existing 402 tests still cover their code paths.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/static/js/portfolio.js

@@ -19,6 +19,16 @@
   const STORAGE_KEY = 'cassandra.pie';
   const UNIVERSE_REFRESH_MS = 60_000;
 
+  // Compliance feature flags — server emits these as data attributes on
+  // #pf-mount (see app/templates/dashboard.html). When false the related
+  // UI is suppressed and the corresponding API call is skipped.
+  function flagEnabled(name) {
+    const m = document.getElementById('pf-mount');
+    return !!(m && m.dataset && m.dataset[name] === 'true');
+  }
+  function aiEnabled()   { return flagEnabled('aiEnabled');   }
+  function syncEnabled() { return flagEnabled('syncEnabled'); }
+
   // --- localStorage ------------------------------------------------------
 
   function loadPie() {
@@ -379,9 +389,9 @@
       // edit-mode only — CSS in portfolio.css hides it when the
       // portfolio panel isn't carrying the .pf-editing class.
       '<div class="pf-actions">' +
-        (pie.analysis && pie.analysis.content
-          ? ''
-          : '<button id="pf-analyze" type="button">Generate AI analysis</button>') +
+        (aiEnabled() && !(pie.analysis && pie.analysis.content)
+          ? '<button id="pf-analyze" type="button">Generate AI analysis</button>'
+          : '') +
         '<button id="pf-forget" type="button" class="pf-secondary">Forget this pie</button>' +
       '</div>' +
       '<div id="pf-analysis" class="pf-analysis" hidden></div>';
@@ -405,7 +415,7 @@
     // regenerate callback closes over the current pie/enriched so a
     // click rebuilds the analysis with the same context that drove
     // the initial render.
-    if (pie.analysis && pie.analysis.content) {
+    if (aiEnabled() && pie.analysis && pie.analysis.content) {
       showAnalysis(pie.analysis, { open: true }, () => runAnalysis(pie, enriched));
     }
   }
@@ -527,9 +537,11 @@
       // Before falling back to "no portfolio", check whether the account
       // has a synced blob this device could restore from. Status is
       // 402 for free-tier users — getStatus() returns paid:false there
-      // and we fall through to the standard empty state.
+      // and we fall through to the standard empty state. When
+      // PORTFOLIO_SYNC_ENABLED=false the sync route 404s, so skip the
+      // status check entirely and render the standard empty state.
       let status = null;
-      if (window.CassandraSync) {
+      if (syncEnabled() && window.CassandraSync) {
         try { status = await window.CassandraSync.getStatus(); }
         catch (e) { console.warn('sync status check failed', e); }
       }