Go-live gate: refuse unsafe live trading

Setting MODE=live alone no longer starts trading. check_live_ready requires an
active risk limit, MAX_POSITION_PCT < 1.0, LIVE_CONFIRMATION exactly
"I UNDERSTAND THE RISK", a minimum balance, and exchange credentials. Enforced
in Runtime.start_many (both start paths) and surfaced at GET /api/live-check;
the dashboard shows a banner and blocks the start buttons. Adds tests.

.env.example

@@ -33,6 +33,13 @@ EXCHANGE_API_SECRET=
 # Set true for testnet/sandbox where supported
 EXCHANGE_SANDBOX=false
 
+# --- Go-live gate (required for MODE=live) ---
+# Live trading only starts when this is exactly "I UNDERSTAND THE RISK".
+# Setting MODE=live alone is intentionally not enough.
+LIVE_CONFIRMATION=
+# Refuse to start live below this account size (quote currency).
+MIN_LIVE_BALANCE=100
+
 # --- Risk controls (0 disables a limit) ---
 # Halt + flatten if the day's loss reaches this amount in quote currency
 MAX_DAILY_LOSS=0