phase G: data minimisation + passwordless auth + DeepSeek-first LLM

Server no longer holds portfolios. Holdings live in the browser
(localStorage); the server publishes an anonymous ticker_universe and a
gzipped /api/universe payload identical for every authenticated user, so
access patterns can't betray which tickers a user holds. AI commentary
is generated ephemerally from the browser-supplied pie and the cost
ledger row records no positions. Migrations 0009-0011 added the
universe table and dropped positions / portfolio_snapshots /
portfolios.

Authentication is now e-mail OTP only. Migration 0010 dropped
password_hash and email_verified (every active session is by
construction proof of email control). The /signup endpoint is gone;
signup and login share a single email-entry page. Email rendering is
HTML+plain-text multipart with a shared brand palette (app/branding.py)
asserted in sync with the CSS by a drift-detection test.

LLM provider defaults to DeepSeek-direct (cheaper, api.deepseek.com)
with OpenRouter as automatic fallback if DeepSeek fails. ai_log_job and
indicator_summary_job now iterate the two tones (NOVICE, INTERMEDIATE)
per cycle so the dashboard's tone toggle is instant; PROMPT_VERSION
bumped to 6 with an educational anti-TA / anti-gambling stance baked
into _CORE. NOVICE mode renders a curated glossary inline (CBOE VIX,
yield curve, HY OAS, etc.) with JS-positioned tooltips that survive
viewport edges and sticky bars. Model name and tokens hidden from the
user UI; still recorded in StrategicLog.model and AICall for admin.

Layout adds a sticky top nav, a sticky bottom markets bar (one chip per
exchange with status LED + headline index + 1d change), and
Phase H feedback reporting is queued in tasks/todo.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/jobs/universe_flush_job.py

@@ -0,0 +1,43 @@
+"""Flush the ticker_universe Redis buffer into the DB at 5-min boundaries.
+
+The buffer is keyed by 5-minute wall-clock buckets:
+`ticker_universe:buffer:<bucket_ts>`. This job runs slightly after each
+boundary and reads the *previous* bucket, ensuring it's closed (no new
+writes can land in it). New tickers are inserted into `ticker_universe`;
+already-known ones have their `last_referenced_at` bumped.
+
+The lag between bucket-close and flush is intentional: it batches
+multiple users' uploads into one INSERT, making timing-correlation
+between "user uploaded at T" and "ticker XYZ appeared at T+δ" weaker.
+"""
+from __future__ import annotations
+
+import asyncio
+
+from app.jobs._helpers import job_lifecycle, log
+from app.services.ticker_universe import evict_stale, flush_buffer
+
+
+async def run() -> None:
+    async with job_lifecycle("universe_flush_job") as (session, run):
+        if run.status == "skipped":
+            return
+        out = await flush_buffer(session)
+        run.items_written = out.get("inserted", 0)
+        log.info("universe_flush.done", **out)
+
+
+async def evict_run() -> None:
+    """Separate daily run: prune entries that haven't been referenced
+    within the eviction TTL (60 days). Kept in this module so all
+    universe-maintenance lives in one place."""
+    async with job_lifecycle("universe_evict_job") as (session, run):
+        if run.status == "skipped":
+            return
+        deleted = await evict_stale(session)
+        run.items_written = deleted
+        log.info("universe_evict.done", deleted=deleted)
+
+
+if __name__ == "__main__":
+    asyncio.run(run())