feat: complete Faza 1 implementation (105 tests green)

All 12 modules built per reviewed plan:
- detector, state_machine (5-state phased FSM), canary, levels Phase B
- notifier fanout (Discord + Telegram, bounded queue, retry, dead-letter)
- audit (JSONL daily rotation), journal, report (weekly R-multiple PnL)
- calibrate + labeler (Tk, lazy-imported), dryrun with acceptance gate
- unified CLI: atm calibrate|label|dryrun|run|journal|report

README + Phase 2 prop-firm TOS audit checklist included.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/phase2-prop-firm-audit.md

@@ -0,0 +1,99 @@
+# Phase 2 — Prop Firm TOS Audit Checklist
+
+Before enabling auto-execution (Faza 2), complete this checklist against the prop firm's Terms of Service and challenge rules. **If any item is PROHIBITED or UNCLEAR, do not proceed with automation.**
+
+Firm audited: ___________________________  
+Account type: ___________________________  
+Date reviewed: __________________________  
+TOS version / URL: ______________________
+
+---
+
+## 1. API / EA / Automation Policy
+
+| # | Question | TOS excerpt (copy exact text) | Status |
+|---|----------|-------------------------------|--------|
+| 1.1 | Is automated trading (bots, EAs, scripts) explicitly **permitted**? | | ☐ Permitted ☐ Prohibited ☐ Not mentioned |
+| 1.2 | Is automation permitted on **challenge** accounts? On **funded** accounts? | | ☐ Both ☐ Challenge only ☐ Funded only ☐ Neither |
+| 1.3 | Is use of **external signals** (signal generated outside the platform) permitted? | | ☐ Permitted ☐ Prohibited ☐ Not mentioned |
+| 1.4 | Is **browser automation / UI scripting** (Playwright, Selenium, AutoHotkey) explicitly prohibited? | | ☐ Prohibited ☐ Not mentioned |
+| 1.5 | Are there restrictions on **co-location** or running the bot from the same machine vs a VPS? | | ☐ Restricted ☐ No restriction |
+
+Notes / action items:  
+_______________________________________________
+
+---
+
+## 2. Account-Type Restrictions
+
+| # | Question | Answer (fill in) | Status |
+|---|----------|-----------------|--------|
+| 2.1 | Is this a **challenge** (evaluation) account? | ☐ Yes ☐ No | |
+| 2.2 | What is the **maximum position size** allowed? | _____ lots | |
+| 2.3 | What is the **maximum drawdown** per day / total? | DD: _____ / _____ | |
+| 2.4 | Is there a **minimum trading days** requirement (to prevent 1-trade fluke)? | _____ days | |
+| 2.5 | Are there **restricted instruments** (no CFDs, no indices, etc.)? | | ☐ US30 allowed ☐ US30 restricted |
+| 2.6 | Are there **restricted trading hours** (news blackout, weekend, etc.)? | | |
+
+Notes:  
+_______________________________________________
+
+---
+
+## 3. Maximum Frequency / Timing Rules
+
+| # | Question | TOS / support response | Status |
+|---|----------|------------------------|--------|
+| 3.1 | Is there a **minimum time between trades** (e.g., 1 trade per N minutes)? | | ☐ Yes — value: _____ ☐ No |
+| 3.2 | Is **high-frequency trading** (more than X trades/day) explicitly prohibited? | | ☐ Prohibited above _____ trades/day ☐ Not restricted |
+| 3.3 | Does the firm detect / flag **robotic timing patterns** (identical ms-precise click times)? | | ☐ Confirmed detection ☐ Not mentioned |
+| 3.4 | Is **jitter / humanised timing** sufficient mitigation, per firm support? | | ☐ Confirmed OK ☐ Not confirmed |
+
+Notes:  
+_______________________________________________
+
+---
+
+## 4. Notification / Disclosure Requirements
+
+| # | Question | Answer | Status |
+|---|----------|--------|--------|
+| 4.1 | Must you **notify the firm** that you are using an automated tool? | | ☐ Required ☐ Not required |
+| 4.2 | Is there a **registration or approval** process for EAs / bots? | | ☐ Required — process: _____ ☐ Not required |
+| 4.3 | Must you disclose the **source of trading signals** (indicator, manual analysis, signal service)? | | ☐ Required ☐ Not required |
+| 4.4 | Are there **data-sharing clauses** requiring strategy disclosure? | | ☐ Yes ☐ No |
+
+Notes:  
+_______________________________________________
+
+---
+
+## 5. Verification Procedure
+
+Steps to take before enabling Faza 2:
+
+- [ ] **5.1** Read the complete TOS, challenge rules, and FAQ. Date of reading: __________
+- [ ] **5.2** Open a support ticket asking explicitly: *"Is Playwright-based browser automation permitted on funded accounts?"* Save the support response.
+- [ ] **5.3** Confirm US30 CFD is an allowed instrument on this account type.
+- [ ] **5.4** Confirm position size (0.1 lots) is within allowed limits.
+- [ ] **5.5** Run the dry-run mode (`atm dryrun`) for at least 5 sessions and verify the simulated click sequence looks correct before going live.
+- [ ] **5.6** Enable **jitter**: ensure `atm/dryrun.py` uses 100–400 ms randomised delays between actions (already in Phase 2 spec).
+- [ ] **5.7** Start with a **paper / demo account** if available, for at least 3 sessions before live.
+- [ ] **5.8** Review `logs/audit.jsonl` after first live auto-execution session for unexpected behaviour.
+
+---
+
+## 6. Decision
+
+Based on the above audit:
+
+- [ ] **GO** — All sections clear. Faza 2 may proceed. Date: __________
+- [ ] **NO-GO** — Section(s) ___________ prohibit or block automation. Tool remains notification-only.
+- [ ] **CONDITIONAL GO** — Proceed after completing actions: ___________________
+
+Sign-off: ___________________________  
+Date: ___________________________
+
+---
+
+*This checklist is a personal risk-management document. It does not constitute legal or financial advice. Re-audit whenever the prop firm updates its TOS or you switch to a new firm.*