Add per-firm banned symbols feature

- lib/db.ts: new firm_banned_symbols table with getBannedSymbols,
  isSymbolBanned, and setBannedSymbol helpers
- app/api/firms/[id]/banned-symbols/route.ts: GET lists banned symbols,
  PATCH toggles a ban for a given symbol
- app/api/firms/route.ts: include bannedSymbols[] in firm list response
- app/firms/[id]/settings/page.tsx: Instruments section shows all
  globally-enabled symbols with a red toggle to ban/unban; banned
  symbols display a "SYMBOL BANNED" pill next to their name
- app/page.tsx: FirmRows shows "ES BANNED" (or current symbol) pill next
  to the firm name when the selected trade symbol is banned for that firm
- lib/auto-trade.ts: skip firms entirely when the trade symbol is banned
- types.ts: add bannedSymbols field to FirmConfig

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/firms/[id]/banned-symbols/route.ts

@@ -0,0 +1,25 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getBannedSymbols, setBannedSymbol } from '@/lib/db';
+
+type Params = { params: Promise<{ id: string }> };
+
+/** GET /api/firms/[id]/banned-symbols — list banned symbols for a firm */
+export async function GET(_req: NextRequest, { params }: Params) {
+    const { id: idStr } = await params;
+    const firmId = parseInt(idStr, 10);
+    if (isNaN(firmId)) return NextResponse.json({ error: 'Invalid id' }, { status: 400 });
+    return NextResponse.json(getBannedSymbols(firmId));
+}
+
+/** PATCH /api/firms/[id]/banned-symbols — { symbol, banned } to ban or unban */
+export async function PATCH(req: NextRequest, { params }: Params) {
+    const { id: idStr } = await params;
+    const firmId = parseInt(idStr, 10);
+    if (isNaN(firmId)) return NextResponse.json({ error: 'Invalid id' }, { status: 400 });
+
+    const { symbol, banned } = await req.json() as { symbol: string; banned: boolean };
+    if (!symbol) return NextResponse.json({ error: 'symbol required' }, { status: 400 });
+
+    setBannedSymbol(firmId, symbol, banned);
+    return NextResponse.json({ firmId, symbol, banned });
+}

app/api/firms/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { getFirms, createFirm } from '@/lib/db';
+import { getFirms, createFirm, getBannedSymbols } from '@/lib/db';
 import { initClient } from '@/lib/clients';
 
 export async function GET() {
@@ -10,6 +10,7 @@ export async function GET() {
             firm: f.name,
             username: f.username,
             password: f.password,
+            bannedSymbols: getBannedSymbols(f.id),
             accounts: f.accounts.map((a) => ({
                 prefix: a.prefix,
                 profitTarget: a.profit_target,