fix: enforce trade-write permission check on v1 ledger trade endpoint

Security Fix:
- Update v1_ledger.py to require trade_write permission instead of read
- Fix authentication dependency from require_read to require_trade_write
- Ensure trade operations cannot be performed with read-only service tokens

Test Coverage:
- Add test_v1_ledger_trade_requires_trade_write_permission() to verify permission boundary
- Confirm read-only tokens are rejected with 403 Forbidden status
- Validate repository methods are not called on permission failure

Documentation:
- Add new Discovery dcy-005 for production admin bootstrap and operator access
- Update docs/discovery/index.md with dcy-005 entry
- Update release rel-001 with additional verification notes and issue references

app/api/v1_ledger.py

@@ -6,14 +6,14 @@ from decimal import Decimal
 
 from fastapi import APIRouter, Depends, HTTPException, Response, status
 
-from app.core.auth import AuthContext, require_read
+from app.core.auth import AuthContext, require_trade_write
 from app.repositories.factory import get_portfolio_repository_from_settings
 from app.schemas.v1 import LedgerTradeRequest, LedgerTradeResponse
 
 router = APIRouter(prefix="/v1", tags=["v1"])
 
 
-def _require_service_token(auth: AuthContext = Depends(require_read)) -> AuthContext:
+def _require_service_token(auth: AuthContext = Depends(require_trade_write)) -> AuthContext:
     if auth.token_source != "db" or auth.token_type != "service":
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,