phase G: data minimisation + passwordless auth + DeepSeek-first LLM

Server no longer holds portfolios. Holdings live in the browser
(localStorage); the server publishes an anonymous ticker_universe and a
gzipped /api/universe payload identical for every authenticated user, so
access patterns can't betray which tickers a user holds. AI commentary
is generated ephemerally from the browser-supplied pie and the cost
ledger row records no positions. Migrations 0009-0011 added the
universe table and dropped positions / portfolio_snapshots /
portfolios.

Authentication is now e-mail OTP only. Migration 0010 dropped
password_hash and email_verified (every active session is by
construction proof of email control). The /signup endpoint is gone;
signup and login share a single email-entry page. Email rendering is
HTML+plain-text multipart with a shared brand palette (app/branding.py)
asserted in sync with the CSS by a drift-detection test.

LLM provider defaults to DeepSeek-direct (cheaper, api.deepseek.com)
with OpenRouter as automatic fallback if DeepSeek fails. ai_log_job and
indicator_summary_job now iterate the two tones (NOVICE, INTERMEDIATE)
per cycle so the dashboard's tone toggle is instant; PROMPT_VERSION
bumped to 6 with an educational anti-TA / anti-gambling stance baked
into _CORE. NOVICE mode renders a curated glossary inline (CBOE VIX,
yield curve, HY OAS, etc.) with JS-positioned tooltips that survive
viewport edges and sticky bars. Model name and tokens hidden from the
user UI; still recorded in StrategicLog.model and AICall for admin.

Layout adds a sticky top nav, a sticky bottom markets bar (one chip per
exchange with status LED + headline index + 1d change), and
Phase H feedback reporting is queued in tasks/todo.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/config.py

@@ -30,6 +30,9 @@ class Settings(BaseSettings):
 
     # Database
     DATABASE_URL: str = "mysql+aiomysql://cassandra:changeme@db:3306/cassandra"
+    # Redis: ephemeral pie storage during /api/analyze + batch buffer for
+    # ticker_universe additions. No persistence — see compose service.
+    REDIS_URL: str = "redis://redis:6379/0"
 
     # API keys (mirror prototype .env names)
     API_KEY: str = ""              # Trading 212 key
@@ -47,14 +50,38 @@ class Settings(BaseSettings):
     # Set to false (or 0/no) to disable /signup after the first account is
     # created. Phase A leaves this open so the operator can self-onboard.
     CASSANDRA_SIGNUP_ENABLED: bool = True
+
+    # SMTP for email OTP verification. If SMTP_SERVER is empty, OTP codes
+    # are written to stdout instead of sent — convenient for local dev.
+    SMTP_SERVER: str = ""
+    SMTP_PORT: int = 587
+    SMTP_USER: str = ""
+    SMTP_PASSWORD: str = ""
+    SMTP_USE_TLS: bool = True
+    SMTP_FROM: str = ""    # Defaults to SMTP_USER if blank
     CASSANDRA_BASE_CURRENCY: str = "GBP"
     CASSANDRA_ANCHOR_DATE: str = ""
     CASSANDRA_MOCK: bool = False
 
-    # AI log
+    # AI log — provider abstraction with fallback chain.
+    # `LLM_PROVIDER` is the primary; `LLM_FALLBACK` kicks in if the primary
+    # raises (after its own internal retries). Set LLM_FALLBACK="" to
+    # disable the fallback.
+    LLM_PROVIDER: str = "deepseek"
+    LLM_FALLBACK: str = "openrouter"
+
+    # DeepSeek-direct (cheaper, primary).
+    DEEPSEEK_API_KEY: str = ""
+    DEEPSEEK_URL: str = "https://api.deepseek.com/chat/completions"
+    DEEPSEEK_MODEL: str = "deepseek-v4-flash"
+
+    # OpenRouter (fallback, also a valid primary).
     OPENROUTER_MODEL: str = "deepseek/deepseek-v4-flash"
     OPENROUTER_MONTHLY_CAP_USD: float = 20.0
-    CASSANDRA_TONE: str = "INTERMEDIATE"      # NOVICE | INTERMEDIATE | PRO
+    # Tone axis. PRO was dropped in PROMPT_VERSION 6 (audience pivot to
+    # young investors); legacy values are silently mapped to INTERMEDIATE
+    # by app.services.openrouter._resolve_tone.
+    CASSANDRA_TONE: str = "INTERMEDIATE"      # NOVICE | INTERMEDIATE
     CASSANDRA_ANALYSIS: str = "SPECULATIVE"   # DRY | SPECULATIVE
 
     # Config file locations (overridable for tests)