Enforce paper-only research mode

[yxuan629-lab]

Summary

• hard-code an unconfigurable PAPER_ONLY = True execution boundary
• remove CLOB client, live order, wallet credential, remote cancellation, and on-chain redemption paths
• retain local paper orders, simulated cancellation, backtesting, research settings, CSV exports, and read-only market data
• remove private-key, funder, signature-type, LIVE, and auto-redeem API/UI controls
• restrict the admin service to localhost-oriented Host, Origin, and client checks
• add migration, security, dependency, test, and baseline reports
• add reproducible development test dependencies and extensive PAPER_ONLY regression coverage

Why

The baseline project exposed real-trading and credential-handling paths that are inappropriate for a strict research build. This change makes the branch fail closed: live credentials reject startup, exchange and Web3 execution implementations are absent, and no configuration switch can restore real trading.

User and developer impact

This branch supports simulated trading and strategy research only. It does not connect a wallet, create real orders, use real funds, sign transactions, or redeem on chain. CLAWBY_API_KEY remains optional for read-only market data; without it the service starts in a restricted data mode.

Validation

• clean Python 3.12 environment installed from requirements-dev.txt
• 53 passed, 2 warnings
• pip check: no broken requirements
• py-clob-client and web3: not installed
• frontend production build: Vite 5.4.21, 4,844 modules, successful
• controlled startup bound to 127.0.0.1:8643
• /health and /admin: HTTP 200
• removed sensitive routes: HTTP 404
• sensitive, malformed, fractional, overflowing, NaN, and Infinity settings: HTTP 400
• simulated order and cancellation smoke tests passed
• service stopped with no residual listener

Known follow-ups

The dependency audit records one high Vite advisory aggregate and one moderate esbuild advisory affecting development-server scenarios. No forced fix or major-version upgrade was applied; upgrading Vite should be evaluated separately with compatibility and browser regression testing.

See SECURITY_AUDIT.md, PAPER_ONLY_MIGRATION.md, DEPENDENCY_AUDIT.md, and TEST_REPORT.md for detailed evidence.