fix: resolve all remaining TODOs, add dev mode auth bypass

- Learning engine: expand default weights from 3 to all 9 strategies
- Learning engine: resolve placeholder strategy_id with DB lookup
- Learning engine: pass strategy_sources from trade execution
- Trade executor: respect trading:paused Redis flag in RiskManager
- Portfolio sync: compute actual daily P&L from day-start snapshot
- Portfolio API: cumulative P&L from first snapshot, read pause flag
- Portfolio metrics: compute max drawdown and avg hold duration
- Add strategy_sources field to TradeExecution schema
- Add dev_mode config (TRADING_DEV_MODE) to bypass auth for local dev
- Dashboard: VITE_DEV_MODE bypasses ProtectedRoute and 401 redirects
- Vite proxy target configurable via VITE_API_TARGET
- Add top-level README.md and remaining-work-plan.md
- Update CLAUDE.md with correct counts and remove stale TODOs
- 404 tests passing

Made-with: Cursor

dashboard/src/components/ProtectedRoute.tsx

@@ -1,11 +1,17 @@
 import type { ReactNode } from 'react';
 import { Navigate } from 'react-router-dom';
 
+const DEV_MODE = import.meta.env.VITE_DEV_MODE === 'true';
+
 interface ProtectedRouteProps {
   children: ReactNode;
 }
 
 export function ProtectedRoute({ children }: ProtectedRouteProps) {
+  if (DEV_MODE) {
+    return <>{children}</>;
+  }
+
   const token = localStorage.getItem('access_token');
 
   if (!token) {