fix: guarantee shadow scan freshness, long-only, user-scoped setup list

Second review round on the shadow book; all three findings were real.

- Scan freshness is now proven, not assumed. Pipeline steps run and fail
  independently, so a disabled or failed scan step still let the shadow
  step run on the newest *stored* setups -- a prior session's picks at
  stale prices. scan_all_tickers now records a run boundary
  (last_scan_run_started_at / _completed_at) only on successful
  completion; the shadow book refuses to trade unless COMPLETED is fresh
  and selects only setups with detected_at >= the run start. Deduplication
  to the latest row per ticker now happens BEFORE qualification, so a newer
  unqualified row suppresses an older qualified one rather than the reverse.

- Shadow selection is hard long-only. setup_qualifies only enforces
  long-only when min_momentum_percentile > 0, but 0 is a legal admin
  setting, and the cash accounting assumes long positions -- so the
  constraint is enforced in shadow selection regardless of gate config.

- The personal setup list excludes only the caller's own open positions.
  get_trade_setups gained exclude_open_trade_user_id; the trades route
  passes the authenticated user, while the Telegram broadcast stays global
  since it has no single owner.

New tests cover stale/absent scan markers, prior-run exclusion, newer
unqualified suppressing older qualified, long-only under a disabled gate,
and both sides of the user-scoped exclusion.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/unit/test_rr_scanner_preservation.py

@@ -603,6 +603,24 @@ async def test_get_trade_setups_can_exclude_tickers_with_open_paper_trades(
     assert "OPENQ" not in discovery_symbols
     assert {"CLOSEDQ", "FREEQ"}.issubset(discovery_symbols)
 
+    # Scoped to a *different* user: OPENQ is user 1's position, so user 2's
+    # personal list must still show it (their list is not filtered by someone
+    # else's holdings).
+    scoped_rows = await get_trade_setups(
+        db_session,
+        exclude_open_trade_tickers=True,
+        exclude_open_trade_user_id=2,
+    )
+    assert "OPENQ" in {row["symbol"] for row in scoped_rows}
+
+    # Scoped to the owning user: their own open position is excluded.
+    owner_rows = await get_trade_setups(
+        db_session,
+        exclude_open_trade_tickers=True,
+        exclude_open_trade_user_id=1,
+    )
+    assert "OPENQ" not in {row["symbol"] for row in owner_rows}
+
     ticker_rows = await get_trade_setups(db_session, symbol="OPENQ")
     assert [row["symbol"] for row in ticker_rows] == ["OPENQ"]