Add multi-factor conviction gate to activation

Make "qualified" mean an edge candidate, not just R:R + confidence.
The gate now also requires (all admin-configurable, defaults on):
- high conviction: recommended_action LONG_HIGH / SHORT_HIGH only
- clean read: risk_level Low (no contradicting signals)
- probable primary target: best target probability >= min (default 60)

- Shared predicate: app/services/qualification.py +
  frontend/src/lib/qualification.ts (mirrored)
- Activation config extended (min_target_probability,
  require_high_conviction, exclude_conflicts) with bool-aware
  get/update + validation
- /trades/performance switched to ?qualified_only=true, applying
  the full gate server-side; confidence breakdown stays unfiltered
- Dashboard "Qualified", Signals "Qualified only" toggle, and
  Track Record all use the one gate; Admin gains the new controls

Sentiment provider runtime config (prior change) included.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/routers/admin.py

@@ -14,6 +14,8 @@ from app.schemas.admin import (
     DataCleanupRequest,
     JobToggle,
     RecommendationConfigUpdate,
+    SentimentConfigUpdate,
+    SentimentTestRequest,
     PasswordReset,
     RegistrationToggle,
     SystemSettingUpdate,
@@ -22,6 +24,7 @@ from app.schemas.admin import (
 )
 from app.schemas.common import APIEnvelope
 from app.services import admin_service
+from app.services import sentiment_provider_service
 from app.services import ticker_universe_service
 
 router = APIRouter(tags=["admin"])
@@ -171,6 +174,41 @@ async def update_activation_settings(
     return APIEnvelope(status="success", data=updated)
 
 
+@router.get("/admin/settings/sentiment", response_model=APIEnvelope)
+async def get_sentiment_settings(
+    _admin: User = Depends(require_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    config = await sentiment_provider_service.get_sentiment_config(db)
+    return APIEnvelope(status="success", data=config)
+
+
+@router.put("/admin/settings/sentiment", response_model=APIEnvelope)
+async def update_sentiment_settings(
+    body: SentimentConfigUpdate,
+    _admin: User = Depends(require_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    config = await sentiment_provider_service.update_sentiment_config(
+        db,
+        provider=body.provider,
+        model=body.model,
+        api_key=body.api_key,
+    )
+    return APIEnvelope(status="success", data=config)
+
+
+@router.post("/admin/settings/sentiment/test", response_model=APIEnvelope)
+async def test_sentiment_settings(
+    body: SentimentTestRequest,
+    _admin: User = Depends(require_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    """Live credentials check: fetch sentiment for one ticker with current config."""
+    result = await sentiment_provider_service.test_sentiment_provider(db, body.ticker)
+    return APIEnvelope(status="success", data=result)
+
+
 @router.get("/admin/settings/ticker-universe", response_model=APIEnvelope)
 async def get_ticker_universe_setting(
     _admin: User = Depends(require_admin),