fix: beta trading pipeline — max_tokens default, approval re-enqueue, credentials

- Migration 031: change ai_agents/agent_variants max_tokens default
  from 32768 to 4096 (32768 exceeds vLLM context window, causing
  HTTP 400 on every extraction)
- API: re-enqueue approved orders to broker queue — previously
  approved orders sat in DB with nothing to execute them
- values-beta: enable TRADING_ENABLED, update Alpaca paper keys

infra/helm/stonks-oracle/values-beta.yaml

@@ -26,8 +26,7 @@ config:
   DEPLOY_STAGE: "beta"
   LOG_LEVEL: "DEBUG"
   JSON_LOGS: "true"
-  # Disable actual trading in beta — safety net
-  TRADING_ENABLED: "false"
+  TRADING_ENABLED: "true"
   # Use same infra services (shared postgres/redis/minio)
   POSTGRES_HOST: "postgresql-rw.postgresql-service.svc.cluster.local"
   POSTGRES_PORT: "5432"
@@ -61,8 +60,8 @@ secrets:
     MINIO_SECRET_KEY: "8fG3!v2rJ7$wN@9mLpQ6zXbC4tKdPqW1"
     REDIS_PASSWORD: "PSCh4ng3me!"
   broker:
-    BROKER_API_KEY: "PKEQXRJUTQCXJYLB4QOQC2LE6"
-    BROKER_API_SECRET: "Df1ZKL6d7F83CDM1jaFDh3K4BxQZJY9VoymoFvEaWiij"
+    BROKER_API_KEY: "PKRTP2PRRNCO3AYRGCK2FGWGMJ"
+    BROKER_API_SECRET: "dWhCubuyzTGDTPqtV1HXdUGhu8ZQB6EP4oui3GRyDTT"
     BROKER_BASE_URL: "https://paper-api.alpaca.markets"
   market:
     MARKET_DATA_API_KEY: "NPwKtrLvoBxcKt3Byp5PEvuZiBZU_d8E"

infra/migrations/031_fix_max_tokens_default.sql

@@ -0,0 +1,15 @@
+-- Fix max_tokens default: 32768 is the full context window, not a reasonable
+-- output limit.  vLLM rejects requests where max_tokens >= context_window
+-- because there's no room left for the input prompt.
+--
+-- Change the column default to 4096 (sufficient for structured JSON extraction
+-- output) and update any existing rows still at the old default.
+
+ALTER TABLE ai_agents ALTER COLUMN max_tokens SET DEFAULT 4096;
+ALTER TABLE agent_variants ALTER COLUMN max_tokens SET DEFAULT 4096;
+
+UPDATE ai_agents SET max_tokens = 4096, updated_at = NOW()
+WHERE max_tokens = 32768;
+
+UPDATE agent_variants SET max_tokens = 4096
+WHERE max_tokens = 32768;

services/api/app.py

@@ -41,7 +41,7 @@ from services.shared.audit import get_entity_audit_trail, get_order_audit_trail,
 from services.shared.config import load_config
 from services.shared.db import get_pg_pool, get_redis
 from services.shared.logging import new_trace_id, set_trace_context, setup_logging
-from services.shared.redis_keys import PREFIX, QUEUE_PREFIX, queue_key
+from services.shared.redis_keys import PREFIX, QUEUE_BROKER, QUEUE_PREFIX, queue_key
 from services.shared.schemas import MAJOR_DECISION_CATALYSTS
 
 logger = logging.getLogger("query_api")
@@ -1391,12 +1391,24 @@ async def review_approval_request(
            SET status = $2, reviewed_by = $3, review_note = $4,
                reviewed_at = $5, updated_at = NOW()
            WHERE id = $1::uuid AND status = 'pending'
-           RETURNING id, ticker, status, reviewed_by""",
+           RETURNING id, ticker, status, reviewed_by, order_job""",
         approval_id, new_status, reviewed_by, review_note, now,
     )
     if not row:
         raise HTTPException(404, "Approval not found or no longer pending")
-    return _row_to_dict(row)
+
+    # Re-enqueue approved orders to the broker queue for execution
+    if approved and rds:
+        order_job = row["order_job"]
+        if isinstance(order_job, str):
+            job_payload = order_job
+        else:
+            job_payload = json.dumps(order_job)
+        await rds.rpush(queue_key(QUEUE_BROKER), job_payload)
+
+    result = _row_to_dict(row)
+    result.pop("order_job", None)
+    return result
 
 
 @app.get("/api/admin/trading/lockouts")