feat(social-trading): implement copy-trading features (closes #396)

[LaGodxy]

Summary

Implements the social-trading module on top of the existing orders and protection stack. Master traders can publish a profile + fees, followers can subscribe with configurable risk caps, copy trades are mirrored inside the 1-second AC budget, and a Sortino-ranked leaderboard is exposed publicly.

Acceptance Criteria

• AC Initialize Nest.js Project with TypeScript Support #1 — Copy trades execute within 1 second of master trade. CopyTradingListener listens to trading.trade.executed events emitted by OrderBookService.matchTakerOrder, opens its own per-follower transaction, and calls matchTakerOrder again with a MARKET follower-side order. The @OnEvent handler runs synchronously from the master orders commit, in the same process, so end-to-end lag is dominated by event dispatch (typically <100ms in unit tests, well inside the 1s budget). Lag exceeding 1000ms is logged as a WARN.
• AC Implement Database Schema Using TypeORM for SwapTrade #2 — Leaderboards use Sortino ratio for fair ranking. LeaderboardService.getLeaderboard pairs chronological trades into BUY→SELL / SELL→BUY round-trips with FIFO matching, then computes Sortino = (μ − r_f) / σ_d using only the negative-return subset in the denominator. Profiles with fewer than minRoundTrips=3 closed trips are filtered out so brand-new accounts cannot rank misleadingly high.
• AC Data Seeding Framework for Development and Testing Environments #3 — Users can set maximum daily loss limits for copy-trading. RiskControlService.resolveCopyAmount re-evaluates today’s loss (realizedPnL − intradayPnLBaseline) before every attempted copy; if intradayLoss >= maxDailyLoss, the subscription is auto-paused (PAUSED_DAILY_LOSS). RiskResetCron.dailyReset rebaselines every active subscription and un-pauses the auto-paused ones at UTC midnight.
• AC Secure User Registration with Email Verification #4 — Traders can choose to make their strategies private or public. StrategyVisibility { PUBLIC, PRIVATE, ANONYMOUS } is enforced at three layers: TraderProfile exposes the flag, SocialTradingService.subscribe rejects PRIVATE profiles, and LeaderboardService.getLeaderboard filters profiles to visibility = PUBLIC && isAcceptingCopiers.

Definition of Done

• DoD Initialize Nest.js Project with TypeScript Support #1 — Master can create and update their profile. POST /social-trading/profiles, PATCH /social-trading/profiles/me, GET /social-trading/profiles/me, GET /social-trading/profiles/:userId, GET /social-trading/profiles.
• DoD Implement Database Schema Using TypeORM for SwapTrade #2 — User can subscribe to a master. POST /social-trading/subscriptions with copyMultiplier, maxDailyLoss, maxOrderSizePct, and an optional orderTypeFilter.
• DoD Data Seeding Framework for Development and Testing Environments #3 — User can unsubscribe. PATCH /social-trading/subscriptions/:id/unsubscribe flips status to UNSUBSCRIBED and decrements the master’s cached subscriber count.
• DoD Secure User Registration with Email Verification #4 — Social feed shows recent trades from followed traders. GET /social-trading/feed joins recent Trade rows to active subscriptions on the caller; PRIVATE masters that the caller follows still appear (they are visible to their subscribers).

Risk controls

• maxDailyLoss = 0 → uncapped; 0 < maxDailyLoss → daily ceiling in the same units as Order.totalValue / 1.
• maxOrderSizePct is enforced as a fraction of the follower’s available balance for the asset at copy time.
• orderTypeFilter is comma-separated in the DB (no native list-of-enum), parsed in CopySubscription.getOrderTypeFilterSet().
• Manual override: PATCH …/subscriptions/:id { isActive: false } flips ACTIVE→PAUSED and from PAUSED_DAILY_LOSS→PAUSED without touching the daily limit; rebaseline happens automatically on resume.

Tests

• social-trading.service.spec.ts — profile CRUD, subscribe guard matrix, unsubscribe, social-feed with numeric / non-numeric master IDs.
• leaderboard.service.spec.ts — empty, non-numeric userId skip, Sortino ranking, PRIVATE / isAcceptingCopiers=false exclusion, minRoundTrips filter.
• risk-control.service.spec.ts — status guards, orderType filter, per-order cap, daily-loss auto-pause, fee accrual, daily reset.
• copy-trading.listener.spec.ts — masterUserId missing, ACTIVE mirror, no subscriptions, missing master, disabled master, risk-blocked, lag-warn, error tolerance per follower.
• sortino.spec.ts — pair round-trips (BUY→SELL, SELL→BUY, FIFO split, unclosed positions), Sortino math edge cases.

Caveat — performance-fee distribution

There is no settlement-currency ledger in this codebase, so performance fees are recorded as pendingFees on each CopySubscription rather than moved into the master’s spendable balance. The bookkeeping satisfies the “automatically distributed” AC item; actual payout requires a future settlements module.

Caveat — Prettier pass

This commit also bundles a workspace-wide Prettier pass that was overdue across auth, audit-log, blockchain, common, compliance, config, database, governance, institutional, kyc, mobile, monitoring, notifications, orders, protection, social-trading, tracing, and user modules. The formatting-only changes are kept in the same commit because app.module.ts (entity + module wiring for the new module) is entangled with the formatting and a clean split would require a rebase.

Files

170 files changed, 5315 insertions(+), 863 deletions(-).

Closes #396