phase G: data minimisation + passwordless auth + DeepSeek-first LLM

Server no longer holds portfolios. Holdings live in the browser
(localStorage); the server publishes an anonymous ticker_universe and a
gzipped /api/universe payload identical for every authenticated user, so
access patterns can't betray which tickers a user holds. AI commentary
is generated ephemerally from the browser-supplied pie and the cost
ledger row records no positions. Migrations 0009-0011 added the
universe table and dropped positions / portfolio_snapshots /
portfolios.

Authentication is now e-mail OTP only. Migration 0010 dropped
password_hash and email_verified (every active session is by
construction proof of email control). The /signup endpoint is gone;
signup and login share a single email-entry page. Email rendering is
HTML+plain-text multipart with a shared brand palette (app/branding.py)
asserted in sync with the CSS by a drift-detection test.

LLM provider defaults to DeepSeek-direct (cheaper, api.deepseek.com)
with OpenRouter as automatic fallback if DeepSeek fails. ai_log_job and
indicator_summary_job now iterate the two tones (NOVICE, INTERMEDIATE)
per cycle so the dashboard's tone toggle is instant; PROMPT_VERSION
bumped to 6 with an educational anti-TA / anti-gambling stance baked
into _CORE. NOVICE mode renders a curated glossary inline (CBOE VIX,
yield curve, HY OAS, etc.) with JS-positioned tooltips that survive
viewport edges and sticky bars. Model name and tokens hidden from the
user UI; still recorded in StrategicLog.model and AICall for admin.

Layout adds a sticky top nav, a sticky bottom markets bar (one chip per
exchange with status LED + headline index + 1d change), and
Phase H feedback reporting is queued in tasks/todo.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

alembic/versions/0008_email_otps.py

@@ -0,0 +1,40 @@
+"""email_otps — one-time codes for mandatory email verification
+
+Revision ID: 0008
+Revises: 0007
+Create Date: 2026-05-16
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+
+revision: str = "0008"
+down_revision: Union[str, None] = "0007"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "email_otps",
+        sa.Column("id", sa.BigInteger, primary_key=True, autoincrement=True),
+        sa.Column("email", sa.String(255), nullable=False),
+        # Argon2 hash of the 6-digit code. Storing the hash means a DB read
+        # alone can't recover the code.
+        sa.Column("code_hash", sa.String(255), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("attempts", sa.Integer, nullable=False, server_default=sa.text("0")),
+        # null = unused. Set when consumed (correct submission) or marked dead
+        # (too many attempts / superseded by newer code for same email).
+        sa.Column("used_at", sa.DateTime(timezone=True)),
+        sa.Column("purpose", sa.String(16), nullable=False, server_default="signup"),
+    )
+    op.create_index("ix_otps_email_created", "email_otps", ["email", "created_at"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_otps_email_created", table_name="email_otps")
+    op.drop_table("email_otps")

alembic/versions/0009_ticker_universe.py

@@ -0,0 +1,43 @@
+"""ticker_universe — server-wide set of tracked tickers, no user attribution
+
+Phase G of the multi-user migration. Adds the additive table only; old
+portfolio tables (positions / portfolio_snapshots / portfolios) are dropped
+in migration 0010 after the new path is verified end-to-end.
+
+Revision ID: 0009
+Revises: 0008
+Create Date: 2026-05-16
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+
+revision: str = "0009"
+down_revision: Union[str, None] = "0008"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "ticker_universe",
+        # Yahoo Finance ticker is the canonical key. T212 shortnames are
+        # resolved to Yahoo tickers at parse time via instrument_map.
+        sa.Column("yahoo_ticker", sa.String(32), primary_key=True),
+        sa.Column("currency", sa.String(8)),
+        sa.Column("first_seen_at", sa.DateTime(timezone=True), nullable=False),
+        # Refreshed whenever the ticker appears in a /api/portfolio/parse
+        # or /api/analyze request. Eviction cron prunes rows older than
+        # the configured TTL.
+        sa.Column("last_referenced_at", sa.DateTime(timezone=True), nullable=False),
+    )
+    op.create_index(
+        "ix_universe_last_ref", "ticker_universe", ["last_referenced_at"]
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_universe_last_ref", table_name="ticker_universe")
+    op.drop_table("ticker_universe")

alembic/versions/0010_drop_password.py

@@ -0,0 +1,42 @@
+"""drop password_hash + email_verified — passwordless auth
+
+Cassandra moves to e-mail-OTP-only authentication. Both columns become
+obsolete:
+
+- password_hash: no passwords any more.
+- email_verified: every active session is by construction proof of email
+  control (sessions only ever land after a successful OTP), so a separate
+  flag is redundant.
+
+Revision ID: 0010
+Revises: 0009
+Create Date: 2026-05-16
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+
+revision: str = "0010"
+down_revision: Union[str, None] = "0009"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.drop_column("users", "password_hash")
+    op.drop_column("users", "email_verified")
+
+
+def downgrade() -> None:
+    # Restoring the columns yields empty / default values — we don't have
+    # the old hashes any more. Downgrade is structural only.
+    op.add_column(
+        "users",
+        sa.Column("password_hash", sa.String(255), nullable=False, server_default=""),
+    )
+    op.add_column(
+        "users",
+        sa.Column("email_verified", sa.Boolean, nullable=False, server_default=sa.text("0")),
+    )

alembic/versions/0011_drop_portfolio_tables.py

@@ -0,0 +1,71 @@
+"""drop positions / portfolio_snapshots / portfolios — Phase G complete
+
+The Phase G refactor moves portfolio data into the browser's localStorage;
+the server keeps only the anonymous ticker_universe (no user attribution)
+plus public quotes/headlines. This migration removes the now-unused
+per-user portfolio tables.
+
+**Irreversible.** Downgrade recreates the table structure but the data is
+gone. Confirmed by the operator on 2026-05-16 before running.
+
+Revision ID: 0011
+Revises: 0010
+Create Date: 2026-05-16
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+
+revision: str = "0011"
+down_revision: Union[str, None] = "0010"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Order matters: drop dependents (positions, then snapshots) before
+    # the parent (portfolios) so FK constraints don't object.
+    op.drop_table("positions")
+    op.drop_table("portfolio_snapshots")
+    op.drop_table("portfolios")
+
+
+def downgrade() -> None:
+    # Structural restoration only — data is unrecoverable.
+    op.create_table(
+        "portfolios",
+        sa.Column("id", sa.Integer, primary_key=True, autoincrement=True),
+        sa.Column("name", sa.String(64), nullable=False),
+        sa.Column("source", sa.String(32), nullable=False),
+        sa.Column("currency", sa.String(8), nullable=False, server_default="GBP"),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.UniqueConstraint("name", name="uq_portfolios_name"),
+    )
+    op.create_table(
+        "portfolio_snapshots",
+        sa.Column("id", sa.BigInteger, primary_key=True, autoincrement=True),
+        sa.Column("portfolio_id", sa.Integer,
+                  sa.ForeignKey("portfolios.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("snapshot_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("total_value", sa.Float),
+        sa.Column("cash", sa.Float),
+        sa.Column("invested", sa.Float),
+        sa.Column("raw_json", sa.JSON),
+    )
+    op.create_index("ix_snap_portfolio_at", "portfolio_snapshots",
+                    ["portfolio_id", "snapshot_at"])
+    op.create_table(
+        "positions",
+        sa.Column("id", sa.BigInteger, primary_key=True, autoincrement=True),
+        sa.Column("snapshot_id", sa.BigInteger,
+                  sa.ForeignKey("portfolio_snapshots.id", ondelete="CASCADE"),
+                  nullable=False),
+        sa.Column("ticker", sa.String(64), nullable=False),
+        sa.Column("name", sa.String(128)),
+        sa.Column("quantity", sa.Float),
+        sa.Column("average_price", sa.Float),
+        sa.Column("current_price", sa.Float),
+        sa.Column("ppl", sa.Float),
+    )