Fix projection bugs + test isolation surfaced while verifying

Running the suite against the cleanup exposed pre-existing breakage (these
tests had not been run since the Postgres migration / recent sync changes):

- _latest_event_payload ordered by `timestamp DESC` with no tie-break, so two
  account snapshots emitted in the same second returned the arbitrary/older one
  (test wanted 101.5k, got 100k). Tie-break on `created_at DESC`.
- query_watch_states_snapshot windowed BOTH event types to the live 45-min
  window; symbol_state_changed (~2k all-time, the watch list itself) must be
  unbounded so the list isn't empty off-hours, while criteria_evaluated (~120k,
  the 112s killer) stays windowed.
- Test isolation: the dashboard tests pass file-path db_paths expecting a fresh
  DB, but under Postgres the path is ignored — they read AND wrote the
  production `public` schema. get_connection now honours MOMENTUM_PG_SCHEMA
  (test-only) to pin all connections in a test to one throwaway schema; an
  autouse fixture sets/drops it. (Cleaned 125 leaked fixture events from prod.)
- FakeClient.get_orders missed the `nested=` kwarg added in ddf93d1.

tests/unit: 134 passed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/alpaca_paper/test_execution_and_sync.py

@@ -43,7 +43,7 @@ class FakeClient:
             }
         ]
 
-    def get_orders(self, status="all", limit=100):
+    def get_orders(self, status="all", limit=100, nested=False):
         return [{"id": "broker-123", "symbol": "GOOD", "status": "filled"}]
 
 
@@ -116,7 +116,7 @@ def test_sync_survives_client_failure(store):
         def get_positions(self):
             raise AlpacaApiError(500, "down")
 
-        def get_orders(self, status="all", limit=100):
+        def get_orders(self, status="all", limit=100, nested=False):
             raise AlpacaApiError(500, "down")
 
     sync = AlpacaPaperSync(store, client=Down(), session_id="t")

tests/unit/api/test_dashboard_api.py

@@ -1,9 +1,12 @@
 """Dashboard API endpoint tests over a real local HTTP server."""
 
 import json
+import os
 import urllib.request
+import uuid
 from datetime import datetime
 
+import psycopg2
 import pytest
 
 from api.main import DashboardState, serve_in_background
@@ -14,6 +17,25 @@ from tests.unit.test_trading_execution import FakeExecutor, make_service
 T0 = datetime(2026, 6, 11, 9, 45)
 
 
+@pytest.fixture(autouse=True)
+def _isolated_pg_schema(monkeypatch):
+    """Pin every connection in this test to one throwaway schema, so the
+    seed store and the dashboard's per-request stores share an ISOLATED
+    database. Without this the file-path db_paths these tests pass fall
+    through to the production ``public`` schema (the path is ignored under
+    Postgres) — they'd read live data and pollute it with fixtures. The
+    ``mem_`` prefix lets the session-scoped conftest cleanup catch any leak."""
+    schema = f"mem_{uuid.uuid4().hex[:12]}"
+    monkeypatch.setenv("MOMENTUM_PG_SCHEMA", schema)
+    yield
+    url = os.environ.get("DATABASE_URL")
+    if url:
+        conn = psycopg2.connect(url)
+        conn.autocommit = True
+        conn.cursor().execute(f'DROP SCHEMA IF EXISTS "{schema}" CASCADE')
+        conn.close()
+
+
 @pytest.fixture
 def server(tmp_path):
     db_path = str(tmp_path / "events.duckdb")