Add Admin control for fundamentals cutover

docs/dolt-integration-plan.md

@@ -502,8 +502,10 @@ that path carries the split guard (`ttm_diluted_eps`
 nulls when contaminated, with `ttm_diluted_eps_caveat`) and the multi-class share
 fallback (`shares_outstanding` + `shares_outstanding_estimated`). Parity and activation
 share the same candidate builder. Activation is the explicit
-`fundamental_data_sec_dolt_cutover_enabled` SystemSetting and defaults off; see
-`docs/fundamentals-deployment.md` for the production flip and rollback procedure.
+`fundamental_data_sec_dolt_cutover_enabled` SystemSetting and defaults off. It is
+managed by the **Fundamentals data source** card in Admin → Settings; while active,
+the weekly legacy collector skips itself so it cannot overwrite the SEC/Dolt cache.
+See `docs/fundamentals-deployment.md` for the production flip and rollback procedure.
 
 **Task 2 — A6 decommissioning.** After a short observation window: remove
 FMP/Finnhub/Alpha Vantage providers, config and env keys; keep monitoring + manual

docs/fundamentals-deployment.md

@@ -163,7 +163,17 @@ The write path is controlled by the SystemSetting
 value other than `true` leaves `fundamental_data` untouched. Before enabling it,
 confirm the normal PostgreSQL backup containing `fundamental_data` is current.
 
-Enable the cutover in PostgreSQL:
+In **Admin → Settings → Fundamentals data source**:
+
+1. Turn on **Use SEC + Dolt for scoring inputs** and accept the confirmation.
+2. Click **Run refresh now**. The SEC import may be `promoted` or `no_op`; either
+   result runs the local cache refresh.
+
+The weekly legacy collector is automatically skipped while the switch is on, so
+it cannot overwrite the activated cache. The switch remains visible even before
+its SystemSetting row exists because the safe default is off.
+
+If the Admin UI is unavailable, enable the cutover directly in PostgreSQL:
 
 ```sql
 INSERT INTO system_settings (key, value, updated_at)
@@ -172,8 +182,7 @@ ON CONFLICT (key) DO UPDATE
 SET value = EXCLUDED.value, updated_at = now();
 ```
 
-Then trigger **SEC Fundamentals Import** once in Admin → Jobs. The import may be
-`promoted` or `no_op`; either result runs the local refresh. Once enabled, the
+Then trigger **SEC Fundamentals Import** once in Admin → Jobs. Once enabled, the
 same refresh also runs after an SEC network/validation failure or a source-lock
 skip, because it reads only PostgreSQL snapshots, earnings events, and closes.
 The job message appends the cache row count and changed score-input count when
@@ -211,12 +220,13 @@ least several scheduled cycles before A6 removes the legacy providers.
 
 ## Failure and rollback
 
-- To stop the A5 cache writes without stopping SEC snapshot ingestion, set
-  `fundamental_data_sec_dolt_cutover_enabled` back to `false` with the SQL above
-  (changing only the value). This prevents the next local refresh but does not
-  restore rows already replaced. Restore `fundamental_data` from the pre-cutover
-  database backup, or—before A6—manually run the legacy Fundamental Collector if
-  its provider keys and quota are still available.
+- To stop the A5 cache writes without stopping SEC snapshot ingestion, turn off
+  **Use SEC + Dolt for scoring inputs** in Admin → Settings. If the UI is
+  unavailable, set `fundamental_data_sec_dolt_cutover_enabled` back to `false`
+  with the SQL above (changing only the value). This prevents the next local
+  refresh but does not restore rows already replaced. Restore `fundamental_data`
+  from the pre-cutover database backup, or—before A6—manually run the legacy
+  Fundamental Collector if its provider keys and quota are still available.
 - Disable a failing source-import job in Admin → Jobs only when ingestion itself
   must stop. Existing promoted snapshots/events remain available.
 - Inspect the job runtime, latest `data_import_runs.validation_json`, service