feat(REQ-005): implement TrEx Basic V1 API contract with auth, assets, ledger, and user endpoints

- Add V1 API routes for assets, ledger, and user info with complete CRUD operations
- Implement authentication scopes and request validation via auth_routes.py
- Extend schemas with V1-specific models for accounts, holdings, and positions
- Add database queries and aggregations for P&L, performance, and account data
- Include comprehensive test coverage for all V1 endpoints and integration flows
- Update batch and release documentation with implementation and verification evidence
- Sync project structure and runtime flows per V1 API contract requirements

Closes implementation phase of BAT-001 (TrEx Basic V1 API Contract)

docs/project-structure.md

@@ -4,8 +4,8 @@
 - Baseline Seed: .stagepilot/bootstrap/baseline.yaml
 - Status: confirmed
 - Owner: repository-maintainers
-- Last Updated (KST): 2026-04-30 22:13
-- Source Discovery / Batch: bootstrap-baseline
+- Last Updated (KST): 2026-05-01 00:00
+- Source Discovery / Batch: bootstrap-baseline, bat-001
 
 ## Project Summary
 - PortfolioHub exposes portfolio management and trading ledger workflows through a FastAPI service and a companion CLI.
@@ -83,16 +83,20 @@
   - Hosts StagePilot skills, document templates, and helper scripts such as stagepilot-doctor and stagepilot-bootstrap-seed.
 - app/api/
   - Defines FastAPI route surfaces for health, authentication, users, strategy sets, and portfolios.
+  - v1 route surfaces: `v1_assets.py` (GET /v1/assets), `v1_user_info.py` (GET /v1/user_info), `v1_ledger.py` (POST /v1/assets/{asset_id}/ledger/trades).
+  - All v1 endpoints require service-token authentication (token_source=db, token_type=service).
 - app/cli/
   - Defines the Typer entrypoint, command groups, output helpers, and operator-facing command flows.
 - app/core/
   - Owns configuration loading, auth guards, security helpers, and shared error handling.
+  - `encryption.py`: Fernet-based credential payload encrypt/decrypt helpers. Reads `CREDENTIAL_ENCRYPTION_KEY` env var via `Settings.require_credential_encryption_key()`.
 - app/domain/
   - Holds framework-light domain models shared by services, routes, and repositories.
 - app/repositories/
   - Provides the repository protocol, repository factory, and concrete Postgres persistence implementation.
 - app/schemas/
   - Defines request and response schemas for HTTP contracts.
+  - `v1.py`: Contract schemas for v1 API (AssetItem, UserInfoResponse, BrokerItem, LedgerTradeRequest/Response).
 - app/services/
   - Implements business logic for auth, portfolios, strategy sets, and users.
 - migrations/
@@ -119,9 +123,9 @@
 
 ## Current Gaps / Planned Changes
 
-- No active Discovery, REQ, Batch, or Release units exist yet; this baseline only bootstraps the document structure.
 - The non-DB repository path intentionally raises a feature-not-ready error when persistence is disabled.
 - Redis and Loki settings exist, but their runtime ownership and module boundaries are not yet represented in active docs.
+- Broker credential write path (upsert) is available only via CLI; no public HTTP API exists for credential registration yet.
 
 ## Update Triggers