feat: stop preview in the arm modal (POST /entry/preview dry run)

[ldamasio]

Summary

• Two consecutive arms on 2026-10-11 got ATR-fallback stops at 0.15% and 0.26% of price and were stopped by noise within seconds; the operator only learned the stop method after the fill (feat: show the technical stop method and confidence on the position card #234 then put METHOD on the card). The arm modal still showed nothing about the stop it was about to use.
• This PR adds a dry run: POST /entry/preview reuses the production detector and engine end to end (same capital base, same TechnicalStopConfig, same invalidation guard, same sizing) without persisting anything or placing orders, and the arm modal gets a STOP PREVIEW panel: technical stop, distance, method and confidence, guard level, size, planned risk and executable trigger/span. Advisory warnings (ATR fallback, medium confidence, distance under 0.5%) turn ARM into ARM ANYWAY; only an explicit domain rejection blocks; an unavailable preview (no candles, metadata down) never blocks.
• Reviewed by Codex (gpt-6.1, xhigh) over four rounds on the branch; final verdict APPROVE, no open findings. Rounds fixed: the preview held the manager read lock across exchange I/O; it populated the production trading-rules cache (and its mutex was held across HTTP); eviction could displace an actively traded symbol; a memo could serve a sizing computed before a capital change; sub-micro prices printed identically.

Changes

• Key changes in this PR:
  • robsond/src/position_manager.rs: prepare_entry_preview(symbol, side) -> EntryPreviewJob (captured under a short manager read guard; the only I/O under it is the local monthly_state read) and EntryPreviewJob::run (candles, balance, metadata, engine decision, after the guard is released). EntryPreview { reference_price, capital_base, analysis, sizing, rejection, unavailable, warnings }. Availability failures (no candles, Insufficient candle data, trading rules unavailable) go to unavailable; engine DomainError goes to rejection.
  • robsond/src/detector.rs: preview_immediate_signal (100 × 15m candles, anchor on last close, create_signal), no events, no tasks.
  • robsond/src/api.rs: preview_entry_handler on the authenticated router only; sliding budget of 6 previews / 60 s across all inputs (429), one preview at a time (429 on overlap), 15 s timeout on the I/O (504). No memoisation.
  • robson-exec/src/ports.rs: ExchangePort::trading_rules_preview (default = normal lookup). robsond/src/binance_exchange.rs: override that reads a fresh cached entry under a momentary lock or fetches exchangeInfo without writing the cache; the production cache is now LRU (last_used_at, updated on fresh and stale hits) and evicts instead of failing closed at 64 symbols.
  • Frontend: robsonApi.previewEntry, EntryPreview types/normalizer, presentation/preview.ts (previewSeverity, previewLines, fmtNum with ≥5 significant digits and scientific notation below 1e-6), STOP PREVIEW panel in ArmModal.svelte keyed to symbol|side so a stale preview never applies to different inputs.
  • CHANGELOG.

Tests

• How to verify:
  • cargo test -p robson-exec -p robsond --features robsond/postgres — 366 robsond + exec tests passed (container, rust 1.92); doc-tests pass; clippy -D correctness -D suspicious clean; cargo +nightly-2026-08-22 fmt --check clean
  • cd frontend && npx vitest run — 138 passed; svelte-check 0 errors
• Added/updated tests:
  • position_manager.rs::preview_entry_sizes_without_persisting_anything, preview_availability_failures_are_not_rejections
  • binance_exchange.rs::trading_rules_cache_evicts_the_least_recently_used_entry_when_full (active symbol survives; stale fallback in use survives)
  • api.rs::preview_budget_admits_at_most_max_per_window
  • frontend/tests/unit/preview.test.ts (severity, lines, unavailable never blocks, small and sub-micro price formatting, normalizer)

Migrations

• No schema changes

Backward Compatibility

• New endpoint and new trait method with a default; existing routes unchanged. The trading-rules cache change (LRU eviction instead of a capacity error) only alters behaviour past 64 distinct symbols, where arms used to fail.
• Merging restarts the daemon pod: merge with an empty book (it is empty now).

Security & Data

• Endpoint is behind the Google ID token layer (ADR-0054), absent from the read-only router. Exchange traffic per preview: two candle fetches, one balance read, at most one exchangeInfo call, bounded by the budget above. No secrets.

Checklist

• Scope is focused and documented
• Code follows project conventions (see docs/DEVELOPER.md)
• Migrations created (if needed) and rationale explained
• Tests added/updated and passing locally
• Docs updated (CHANGELOG)

🤖 Generated with Claude Code