Add TopstepX platform support, drain withdrawal stages, and perfect-path calendar projection

- TopstepXClient (ProjectX Gateway): API-key auth, SignalR user hub,
  Trade/search daily P&L, emulated OCO exits, books-invariant
  withdrawal detection for $0-start accounts
- Platform-aware client pool, credentials (api_key column), and
  credential form; $0-size account types match by prefix alone
- Drain stages: min-day ($5-$15 randomized) MNQ legs for the
  configured days, then wait for the 50% withdrawal; stage pills
  show 'Stage N – Drain'
- Account calendar projects the perfect path: future days book their
  planned targets, simulated 50% withdrawals, payout marker

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/api/firms/[id]/credentials/route.ts

@@ -5,24 +5,35 @@ import { reconcileClients, removeClient } from '@/lib/clients';
 
 type Params = { params: Promise<{ id: string }> };
 
-/** The Tradovate login for one firm. This is the only firm data this machine
+/** The platform login for one firm. This is the only firm data this machine
  *  owns — everything else comes from the master catalog, and these credentials
- *  never go the other way. */
+ *  never go the other way.
+ *
+ *  Tradovate firms need username + password. TopstepX firms need the API key;
+ *  username is optional for now (the loginKey call still wants it, so the
+ *  client sits idle with a clear error until one is added) and password is
+ *  unused. */
 export async function PUT(req: NextRequest, { params }: Params) {
     const { id } = await params;
 
     const firm = getCachedFirm(id);
     if (!firm) return NextResponse.json({ error: 'Firm not found' }, { status: 404 });
 
-    const body = await req.json() as { username?: string; password?: string };
+    const body = await req.json() as { username?: string; password?: string; apiKey?: string };
     const username = body.username?.trim() ?? '';
     const password = body.password?.trim() ?? '';
-    if (!username || !password) {
+    const apiKey = body.apiKey?.trim() ?? '';
+
+    if (firm.platform === 'topstepx') {
+        if (!apiKey) {
+            return NextResponse.json({ error: 'apiKey is required for a TopstepX firm' }, { status: 400 });
+        }
+    } else if (!username || !password) {
         return NextResponse.json({ error: 'username and password are required' }, { status: 400 });
     }
 
     try {
-        setCredentials(id, firm.name, username, password);
+        setCredentials(id, firm.name, username, password, apiKey);
         // Picks up the new login immediately rather than at the next restart.
         reconcileClients();
         return NextResponse.json({ ok: true });

app/api/firms/route.ts

@@ -18,11 +18,15 @@ export async function GET() {
     try {
         const result: FirmConfig[] = getCachedCatalog().map((firm) => {
             const creds = getCredentials(firm.id);
+            const hasCredentials = firm.platform === 'topstepx'
+                ? !!creds?.apiKey
+                : !!(creds?.username && creds?.password);
             return {
                 id: firm.id,
                 firm: firm.name,
+                platform: firm.platform,
                 username: creds?.username ?? '',
-                hasCredentials: !!creds,
+                hasCredentials,
                 bannedSymbols: firm.bannedSymbols,
                 accounts: firm.accountTypes.map((a) => ({
                     id: a.id,