Admin panel (:8767): config, profiles, service control, paper/live switch

New admin service — LAN-only, token-authed (ADMIN_TOKEN), card-based UI
matching the owner's preferred dashboard style. Capabilities:
- health: docker containers via /var/run/docker.sock (stdlib unix-socket
  HTTP client), DB heartbeat, Alpaca account/clock, Ollama, feed
- config: whitelisted strategy knobs (TRADING_/TRIGGER_/WATCHER_/...)
  edited via data/overrides.env, which every entrypoint now loads with
  override=True at boot (runtime/env_overrides.py) — so changes apply on
  container restart without touching the deployment YAML; secrets are
  presence-only and rejected server-side if edited
- profiles: named knob presets (seeded: validated-core, conservative,
  squeeze-hunter) applied in one click
- restart buttons per container; paper/live switch guarded behind
  ALPACA_LIVE_* keys existing
Verified live in docker: auth 401s, status/config/profiles/write paths,
secret-edit rejection, page serves. Added to both compose files.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

run_live_paper.py

@@ -139,6 +139,8 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
 def build_runtime(args: argparse.Namespace) -> dict:
     """Wire up every component; safe without API keys."""
     load_dotenv()
+    from runtime.env_overrides import load as _load_overrides
+    _load_overrides()  # admin-panel overrides beat compose env
 
     explicit_symbols = [s.strip().upper() for s in args.symbols.split(",") if s.strip()]