feat: autonomous trading engine — full implementation

- Database migration 018 with 13 tables for trading engine state
- Trading engine service (services/trading/) with 12 pure computation modules:
  position sizer, stop-loss manager, reserve pool, circuit breaker,
  risk tier controller, correlation matrix, tax lots, trading window,
  gradual entry, notifications, micro-trading, backtester
- Core TradingEngine with pre-trade evaluation pipeline and integration wiring
- FastAPI HTTP service with 14 endpoints (health, config, decisions, metrics, backtest)
- Performance tracker with Sharpe ratio, drawdown, profit factor computation
- 194 Python tests (165 property-based + 29 integration)
- Frontend: 13 TanStack Query hooks, 7 dashboard panels, tabbed Trading Engine page
- Helm chart entry, network policy, nginx proxy, ingress for trading-engine
- Shared infrastructure: enums, Redis keys, TradingConfig in AppConfig

infra/helm/stonks-oracle/templates/ingress.yaml

@@ -102,6 +102,31 @@ spec:
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
+metadata:
+  name: stonks-trading-engine-https
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.hosts.tradingEngine }}
+      secretName: stonks-trading-tls
+  rules:
+    - host: {{ .Values.ingress.hosts.tradingEngine }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: trading-engine
+                port:
+                  number: 8000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
 metadata:
   name: stonks-dashboard-https
   namespace: {{ .Release.Namespace }}

infra/helm/stonks-oracle/templates/network-policies.yaml

@@ -83,6 +83,59 @@ spec:
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
+metadata:
+  name: allow-trading-engine-ingress
+  namespace: {{ .Release.Namespace }}
+spec:
+  podSelector:
+    matchLabels:
+      app: trading-engine
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: query-api
+        - podSelector:
+            matchLabels:
+              app: dashboard
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: TCP
+          port: 8000
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: postgresql-service
+      ports:
+        - protocol: TCP
+          port: 5432
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: redis-service
+      ports:
+        - protocol: TCP
+          port: 6379
+    - to: []
+      ports:
+        - protocol: TCP
+          port: 443
+    - to:
+        - namespaceSelector: {}
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: allow-superset-ingress
   namespace: {{ .Release.Namespace }}

infra/helm/stonks-oracle/values.yaml

@@ -91,6 +91,20 @@ services:
       requests: { cpu: 100m, memory: 128Mi }
       limits: { cpu: 500m, memory: 256Mi }
 
+  tradingEngine:
+    replicas: 1
+    image: trading-engine
+    command: "uvicorn services.trading.app:app --host 0.0.0.0 --port 8000"
+    tier: trading
+    port: 8000
+    secrets: [stonks-core-secrets, stonks-broker-secrets]
+    resources:
+      requests: { cpu: 100m, memory: 256Mi }
+      limits: { cpu: 500m, memory: 512Mi }
+    probes:
+      readiness: { path: /ready, port: 8000, initialDelay: 5, period: 10 }
+      liveness: { path: /health, port: 8000, initialDelay: 10, period: 30 }
+
   riskEngine:
     replicas: 1
     image: risk
@@ -223,6 +237,7 @@ ingress:
     dashboard: stonks.celestium.life
     superset: stonks-dash.celestium.life
     trino: stonks-trino.celestium.life
+    tradingEngine: stonks-trading.celestium.life
 
 ## Analytics stack
 trino: