Add auto-trade scheduler with batch locking, commission gross-up, and sync gate

- Auto-trade scheduler fires every 60s; uses Promise.allSettled batch so no new trades fire while any position from the current batch is open
- Commission gross-up: read entryCommission from cash.realizedPnL after fill (fallback 2.5×contracts), grossTarget = target + 2×entryCommission
- Sync gate: TradovateClient.syncComplete flag; scheduler skips tick until every client finishes initial position/balance sync
- Contracts formula changed to Math.ceil so $1500 target = 2 contracts
- Removed all fee caching (perContractFees, recentFills, fillFee handler) from tradovate-class.ts
- Removed firm_fees table, getFirmFees, upsertFirmFee from db.ts
- Deleted instrument-configs API routes; removed Fees UI from firm settings page
- /api/instruments returns full {symbol, enabled}[] objects; dashboard filters to enabled-only for trade selector
- Added auto-trade, debug, orders, settings, and trade API routes
- Instrument selector on dashboard now driven by enabled instruments from DB

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/firms/[id]/debug-contracts/route.ts

@@ -0,0 +1,33 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getClients } from '@/lib/clients';
+import axios from 'axios';
+
+export async function GET(
+    req: NextRequest,
+    { params }: { params: Promise<{ id: string }> }
+) {
+    try {
+        const { id } = await params;
+        const firmId = parseInt(id, 10);
+        const clients = getClients();
+        const client = clients.get(firmId) as any;
+        if (!client) return NextResponse.json({ error: 'Client not found' }, { status: 404 });
+
+        const symbol = req.nextUrl.searchParams.get('symbol') ?? 'NQ';
+        const accessToken = client.accessInfo?.accessToken;
+        if (!accessToken) return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
+
+        const res = await axios.get(
+            `https://demo.tradovateapi.com/v1/contract/suggest?t=${encodeURIComponent(symbol)}&l=20`,
+            { headers: { Authorization: `Bearer ${accessToken}` } }
+        );
+
+        return NextResponse.json({
+            symbol,
+            contracts: res.data,
+            recentEntityEvents: client.recentEntityEvents ?? [],
+        });
+    } catch (err: any) {
+        return NextResponse.json({ error: err?.message }, { status: 500 });
+    }
+}