fix: harden shadow book against book leakage (review of ba2df8b)

Review of the shadow book found seven ways the two books could leak into
each other; all are fixed here. The most serious silently invalidated the
comparison the shadow book exists to make.

- Shadow holdings no longer suppress the manual candidate list. The
  open-trade exclusion filtered on any book, so shadow taking the
  top-ranked names removed exactly those from the user's list and alerts,
  confining the discretionary book to leftovers. Scoped to the manual
  book. Closed-trade alerts and paper-book equity were leaking the same
  way and are likewise scoped.

- Shadow sizing now matches _simulate_portfolio: min(1% risk, 20% notional
  cap, available cash) from marked equity, plus the sub- dust guard.
  Previously risk-only from realized equity, so a tight stop produced a
  multiples-of-equity leveraged position the strategy would never take.

- Shadow only trades setups from the scan that just ran (<6h old) with one
  setup per ticker. A failed or disabled scan step could otherwise open
  positions from a prior session at stale prices.

- Gate-reset transitions are observed for both books, so a shadow stop-out
  completes fail -> requalify instead of staying locked forever.

- Manual list/close endpoints default to the manual book and reject
  hand-closing shadow trades; the performance endpoint is scoped to the
  caller so 'your picks' is not every user's book.

- run_shadow_book is registered as a paused job so Admin can trigger it.

Also anchors three pre-existing paper-trade tests (and the new alpaca
window test) on the UTC date. They build fixtures from the local date but
the service stamps opened_at in UTC, so they failed only between 00:00 and
02:00 in a UTC+hh timezone -- latent on ba2df8b, exposed by the clock.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/unit/test_shadow_book_service.py

@@ -78,6 +78,27 @@ class TestSizing:
     def test_zero_risk_distance_takes_no_position(self):
         assert shadow_book_service.position_shares(100_000, 1.0, 100.0, 100.0) == 0.0
 
+    def test_tight_stop_is_capped_at_the_notional_limit(self):
+        """Without the cap, 1% risk on a $0.50 stop is a 2x-equity position."""
+        shares = shadow_book_service.position_shares(100_000, 1.0, 100.0, 99.5)
+        # Risk sizing alone wants 2,000 shares ($200k); the 20% cap allows 200.
+        assert shares == pytest.approx(200.0)
+        assert shares * 100.0 <= 100_000 * shadow_book_service.NOTIONAL_CAP
+
+    def test_cannot_spend_cash_it_does_not_have(self):
+        shares = shadow_book_service.position_shares(
+            100_000, 1.0, 100.0, 95.0, cash_available=5_000
+        )
+        assert shares == pytest.approx(50.0)
+
+    def test_no_cash_means_no_position(self):
+        assert (
+            shadow_book_service.position_shares(
+                100_000, 1.0, 100.0, 95.0, cash_available=0
+            )
+            == 0.0
+        )
+
 
 class TestSelection:
     @pytest.mark.asyncio
@@ -151,6 +172,41 @@ class TestSelection:
         assert summary["skipped_locked"] == 1
 
 
+class TestSetupFreshness:
+    @pytest.mark.asyncio
+    async def test_ignores_setups_from_a_previous_session(self, session):
+        """If the scan step failed or was disabled, the newest stored setups are
+        yesterday's — trading them would enter stale picks at stale prices."""
+        ids = await _seed(session, ["AAA"])
+        stale = datetime.now(timezone.utc) - timedelta(days=1)
+        session.add(_setup(ids["AAA"], rank=0.9, detected=stale))
+        await session.commit()
+
+        summary = await shadow_book_service.open_shadow_positions(
+            session, activation_config=_CONFIG
+        )
+
+        assert summary["opened"] == 0
+
+    @pytest.mark.asyncio
+    async def test_one_position_per_ticker_from_duplicate_setups(self, session):
+        ids = await _seed(session, ["AAA"])
+        now = datetime.now(timezone.utc)
+        session.add_all(
+            [
+                _setup(ids["AAA"], rank=0.5, detected=now - timedelta(minutes=30)),
+                _setup(ids["AAA"], rank=0.9, detected=now),
+            ]
+        )
+        await session.commit()
+
+        summary = await shadow_book_service.open_shadow_positions(
+            session, activation_config=_CONFIG
+        )
+
+        assert summary["opened"] == 1
+
+
 class TestBookIsolation:
     @pytest.mark.asyncio
     async def test_gate_locks_do_not_leak_between_books(self, session):
@@ -184,6 +240,7 @@ class TestBookIsolation:
         )
         await session.commit()
 
-        equity = await shadow_book_service.current_equity(session, 100_000.0)
+        equity, cash = await shadow_book_service.equity_and_cash(session, 100_000.0, [])
 
         assert equity == 100_000.0
+        assert cash == 100_000.0