fix: resolve all remaining TODOs, add dev mode auth bypass

- Learning engine: expand default weights from 3 to all 9 strategies
- Learning engine: resolve placeholder strategy_id with DB lookup
- Learning engine: pass strategy_sources from trade execution
- Trade executor: respect trading:paused Redis flag in RiskManager
- Portfolio sync: compute actual daily P&L from day-start snapshot
- Portfolio API: cumulative P&L from first snapshot, read pause flag
- Portfolio metrics: compute max drawdown and avg hold duration
- Add strategy_sources field to TradeExecution schema
- Add dev_mode config (TRADING_DEV_MODE) to bypass auth for local dev
- Dashboard: VITE_DEV_MODE bypasses ProtectedRoute and 401 redirects
- Vite proxy target configurable via VITE_API_TARGET
- Add top-level README.md and remaining-work-plan.md
- Update CLAUDE.md with correct counts and remove stale TODOs
- 404 tests passing

Made-with: Cursor

.claude/CLAUDE.md

@@ -5,8 +5,9 @@ Automated stock trading bot combining news sentiment analysis with technical str
 
 ## Architecture
 - **7 microservices**: news-fetcher, sentiment-analyzer, signal-generator, trade-executor, learning-engine, api-gateway, dashboard
-- **Shared libraries** in `shared/`: config, redis_streams, telemetry, db, models, schemas, broker abstraction, strategies
+- **Shared libraries** in `shared/`: config, redis_streams, telemetry, db, models, schemas, broker abstraction, 9 strategies, fundamentals providers
 - **Infra**: PostgreSQL+TimescaleDB, Redis Streams, Ollama (local LLM), Docker Compose
+- **CI/CD**: Woodpecker pipeline → Docker build → Kubernetes deploy
 - **Brokerage**: Alpaca (paper trading) via abstraction layer in `shared/broker/`
 
 ## Key Design Decisions
@@ -32,10 +33,11 @@ trading-bot/
 │   ├── redis_streams.py # StreamPublisher + StreamConsumer
 │   ├── telemetry.py     # OpenTelemetry setup
 │   ├── db.py            # Async engine + sessionmaker
-│   ├── models/          # SQLAlchemy models (14 tables)
+│   ├── models/          # SQLAlchemy models (16 tables)
 │   ├── schemas/         # Pydantic v2 schemas (message types)
 │   ├── broker/          # BaseBroker ABC + AlpacaBroker
-│   └── strategies/      # BaseStrategy + 3 implementations
+│   ├── fundamentals/    # Alpha Vantage, FMP, Yahoo providers + cache
+│   └── strategies/      # BaseStrategy + 9 implementations
 ├── services/
 │   ├── news_fetcher/    # RSS + Reddit → news:raw
 │   ├── sentiment_analyzer/ # FinBERT + Ollama → news:scored
@@ -90,10 +92,8 @@ trading-bot/
 - Code review was started but not completed — should be done before production use
 - JWT test warnings about short HMAC keys (test-only, production keys should be 32+ bytes)
 - Integration tests mock FinBERT and Alpaca — need real integration tests with live services
-- No CI/CD pipeline yet
 - Twitter/X source not implemented in news fetcher (only RSS + Reddit)
 - Dashboard has no unit tests (only build verification)
-- Strategy conflict during Sprint 3 merge — both signal-generator and strategies agents created `shared/strategies/`; resolved by keeping the dedicated strategies agent's versions
 
 ## How This Was Built
 - Built in 6 sprints using parallel subagent worktrees