chore: decommission FMP, Finnhub and Alpha Vantage (A6)

The A5 cutover has been on and observed in production, so SEC Company Facts +
DoltHub earnings are already the live source for `fundamental_data`. This
removes everything the legacy path still occupied.

Gone: the three providers and their config/env keys; the weekly
`fundamental_collector` job; the cutover toggle (SEC + Dolt is now the
unconditional path, so `off` can no longer silently freeze scoring inputs); the
A5 parity report, whose deltas became structurally zero once the candidate
builder started writing the table it compared against; and the FMP tier of
universe bootstrap.

Two behavioral notes:

- Disabling **SEC Fundamentals Import** now stops the SEC network fetch only.
  The local cache refresh moved outside the job-enable check, because candidates
  also derive from daily closes and earnings events — freezing those on an
  ingestion pause would stale scoring with no fallback left to recover from.
- `/ingestion/fetch?sources=fundamentals` still accepts the key and reports
  `skipped`; there is no per-ticker fetch any more.

Migration 029 does not blanket-delete the leftover settings rows. Migrations run
before the service restart, and pre-A6 code reads an absent `job_*_enabled` row
as *enabled* — so the two behavior-bearing keys become tombstones pinned to safe
values (hidden in Admin) and only the inert three are deleted. Removing the
provider keys from the production `.env` is the matching rollout step.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/test_ingestion_fundamentals_source.py

@@ -0,0 +1,38 @@
+"""A6: `sources=fundamentals` is accepted but never fetches from a provider.
+
+`fundamental_data` is rebuilt for the whole universe by the nightly SEC + Dolt
+imports, so there is no per-ticker fetch left. The source key stays valid so an
+older client gets a truthful `skipped` instead of a silent omission.
+"""
+
+from __future__ import annotations
+
+from app.models.ticker import Ticker
+
+
+async def test_fundamentals_source_reports_skipped(client, db_session):
+    from app.dependencies import require_access
+    from app.main import app
+
+    app.dependency_overrides[require_access] = lambda: None
+    try:
+        db_session.add(Ticker(symbol="AAPL"))
+        await db_session.flush()
+
+        resp = await client.post(
+            "/api/v1/ingestion/fetch/AAPL", params={"sources": "fundamentals"}
+        )
+        assert resp.status_code == 200
+        source = resp.json()["data"]["sources"]["fundamentals"]
+        assert source["status"] == "skipped"
+        assert "SEC + Dolt" in source["message"]
+    finally:
+        app.dependency_overrides.pop(require_access, None)
+
+
+def test_fundamentals_remains_a_recognised_source_key():
+    """Older clients keep getting an entry for it rather than a missing key."""
+    from app.routers.ingestion import _parse_requested_sources
+
+    assert "fundamentals" in _parse_requested_sources("fundamentals")
+    assert "fundamentals" in _parse_requested_sources(None)  # None => all sources