fix: harden shadow book against book leakage (review of ba2df8b)

Review of the shadow book found seven ways the two books could leak into
each other; all are fixed here. The most serious silently invalidated the
comparison the shadow book exists to make.

- Shadow holdings no longer suppress the manual candidate list. The
  open-trade exclusion filtered on any book, so shadow taking the
  top-ranked names removed exactly those from the user's list and alerts,
  confining the discretionary book to leftovers. Scoped to the manual
  book. Closed-trade alerts and paper-book equity were leaking the same
  way and are likewise scoped.

- Shadow sizing now matches _simulate_portfolio: min(1% risk, 20% notional
  cap, available cash) from marked equity, plus the sub- dust guard.
  Previously risk-only from realized equity, so a tight stop produced a
  multiples-of-equity leveraged position the strategy would never take.

- Shadow only trades setups from the scan that just ran (<6h old) with one
  setup per ticker. A failed or disabled scan step could otherwise open
  positions from a prior session at stale prices.

- Gate-reset transitions are observed for both books, so a shadow stop-out
  completes fail -> requalify instead of staying locked forever.

- Manual list/close endpoints default to the manual book and reject
  hand-closing shadow trades; the performance endpoint is scoped to the
  caller so 'your picks' is not every user's book.

- run_shadow_book is registered as a paused job so Admin can trigger it.

Also anchors three pre-existing paper-trade tests (and the new alpaca
window test) on the UTC date. They build fixtures from the local date but
the service stamps opened_at in UTC, so they failed only between 00:00 and
02:00 in a UTC+hh timezone -- latent on ba2df8b, exposed by the clock.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/unit/test_alpaca_provider_window.py

@@ -43,11 +43,19 @@ def _utcnow() -> datetime:
     return datetime.now(timezone.utc).replace(tzinfo=None)
 
 
+def _utc_today() -> date:
+    """The provider clamps against UTC, so the fixture must use the UTC date.
+
+    ``date.today()`` is local and runs a day ahead in a UTC+hh timezone just
+    after midnight, which would assert against a day the clamp cannot reach."""
+    return datetime.now(timezone.utc).date()
+
+
 @pytest.mark.asyncio
 async def test_todays_in_progress_bar_is_inside_the_window():
     """The whole near-close design depends on today's bar being fetchable."""
     provider, client = _provider()
-    today = date.today()
+    today = _utc_today()
 
     await provider.fetch_ohlcv("AAPL", today - timedelta(days=5), today)
 
@@ -60,7 +68,7 @@ async def test_window_stays_out_of_the_delayed_data_period():
     """A window reaching the last ~15 minutes fails the entire request."""
     provider, client = _provider()
 
-    await provider.fetch_ohlcv("AAPL", date.today() - timedelta(days=5), date.today())
+    await provider.fetch_ohlcv("AAPL", _utc_today() - timedelta(days=5), _utc_today())
 
     assert client.request.end <= _utcnow() - timedelta(minutes=15)
 
@@ -69,7 +77,7 @@ async def test_window_stays_out_of_the_delayed_data_period():
 async def test_completed_past_day_is_fully_covered():
     """Clamping must not swallow the last day of a historical window."""
     provider, client = _provider()
-    end_date = date.today() - timedelta(days=3)
+    end_date = _utc_today() - timedelta(days=3)
 
     await provider.fetch_ohlcv("AAPL", end_date - timedelta(days=5), end_date)
 
@@ -80,7 +88,7 @@ async def test_completed_past_day_is_fully_covered():
 async def test_window_collapsing_to_nothing_skips_the_call():
     """A start inside the delayed period yields no request at all, not an error."""
     provider, client = _provider()
-    tomorrow = date.today() + timedelta(days=1)
+    tomorrow = _utc_today() + timedelta(days=2)
 
     records = await provider.fetch_ohlcv("AAPL", tomorrow, tomorrow)