fix: resolve all remaining TODOs, add dev mode auth bypass

- Learning engine: expand default weights from 3 to all 9 strategies
- Learning engine: resolve placeholder strategy_id with DB lookup
- Learning engine: pass strategy_sources from trade execution
- Trade executor: respect trading:paused Redis flag in RiskManager
- Portfolio sync: compute actual daily P&L from day-start snapshot
- Portfolio API: cumulative P&L from first snapshot, read pause flag
- Portfolio metrics: compute max drawdown and avg hold duration
- Add strategy_sources field to TradeExecution schema
- Add dev_mode config (TRADING_DEV_MODE) to bypass auth for local dev
- Dashboard: VITE_DEV_MODE bypasses ProtectedRoute and 401 redirects
- Vite proxy target configurable via VITE_API_TARGET
- Add top-level README.md and remaining-work-plan.md
- Update CLAUDE.md with correct counts and remove stale TODOs
- 404 tests passing

Made-with: Cursor

tests/services/test_portfolio_sync.py

@@ -231,15 +231,18 @@ class TestSyncOnce:
         existing_aapl.qty = 5.0  # old qty
         existing_aapl.avg_entry = 140.0  # old entry
 
+        # Day-start snapshot query (returns None = first snapshot today)
+        result_day_start = MagicMock()
+        result_day_start.scalar_one_or_none.return_value = None
+
         result_aapl = MagicMock()
         result_aapl.scalar_one_or_none.return_value = existing_aapl
         result_msft = MagicMock()
         result_msft.scalar_one_or_none.return_value = None
 
-        # First execute call is for the delete of stale positions;
-        # but within the loop, select calls come first
+        # Execute calls: day-start snapshot, AAPL lookup, MSFT lookup, DELETE
         mock_session.execute = AsyncMock(
-            side_effect=[result_aapl, result_msft, MagicMock()]
+            side_effect=[result_day_start, result_aapl, result_msft, MagicMock()]
         )
 
         await _sync_once(mock_broker, mock_session_factory)