feat(bat-020): daemon-scoped 브로커 인증정보 (REQ-046~051)

- REQ-046: BrokerCredential.daemon_id 필드 추가, repository 시그니처 갱신
- REQ-047: alembic revision Step1(daemon_id NULL 컬럼 추가), Step2(PK 전환, dev/test DB 한정)
- REQ-048: backfill-daemon-id CLI subcommand (--dry-run/--force/--broker 지원)
- REQ-049: GET /v1/user_info daemon-scoped 단일 broker 전달 (brokers→broker, daemon_id 없으면 403)
- REQ-050: credential set/list/remove --daemon-id 옵션 추가 (daemon_slug 해석)
- REQ-051: 보안 격리 - service-token 전용, web 토큰 차단, 로그 app_secret 비노출, graceful degrade

비가역 결재 게이트: REQ-047 Step2(PK 전환)는 사장님 결재 후 실DB 적용 예정(이 batch는 revision 코드만)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VHtM5Ws1HKCKQ4JGi6GRb5

app/api/v1_user_info.py

@@ -31,41 +31,59 @@ def get_user_info(
     auth: AuthContext = Depends(_require_service_token),
     settings: Settings = Depends(get_settings),
 ) -> UserInfoResponse:
+    # REQ-049, REQ-051: daemon_id 없으면 403 (daemon-scoped 인가 규율)
+    if auth.daemon_id is None:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="daemon_id binding required",
+        )
+
     repo = get_portfolio_repository_from_settings(settings)
     try:
         user = repo.get_user(auth.user_id)  # type: ignore[arg-type]
 
-        # Fetch broker credentials and decrypt
-        brokers: list[BrokerItem] = []
+        # REQ-049: daemon_id로 단일 broker 인증정보 조회 및 복호화
+        broker_item: BrokerItem | None = None
         try:
-            credentials = repo.list_broker_credentials(auth.user_id)  # type: ignore[arg-type]
-            enc_key: str | None = None
-            for cred in credentials:
+            credentials = repo.list_broker_credentials(  # type: ignore[call-arg]
+                auth.user_id,  # type: ignore[arg-type]
+                daemon_id=auth.daemon_id,
+            )
+            if credentials:
+                cred = credentials[0]
                 credential_payload = None
                 try:
-                    if enc_key is None:
-                        enc_key = settings.require_credential_encryption_key()
+                    enc_key = settings.require_credential_encryption_key()
                     raw = decrypt_payload(enc_key, cred.encrypted_payload)
                     credential_payload = json.loads(raw)
                 except (InvalidToken, RuntimeError, Exception) as exc:
-                    logger.warning("credential decryption failed for broker %s: %s", cred.broker, exc)
-                brokers.append(BrokerItem(
+                    # REQ-051 AC-8: 로그에 app_key, app_secret 값 미포함
+                    # exc는 Fernet 토큰 오류 메시지만 포함하며 credential 값을 담지 않는다.
+                    logger.warning(
+                        "credential decryption failed for broker %s daemon %s: %s",
+                        cred.broker,
+                        auth.daemon_id,
+                        type(exc).__name__,
+                    )
+                broker_item = BrokerItem(
                     broker=cred.broker,
                     account_ref=cred.account_ref,
                     credential_payload=credential_payload,
                     credential_version=cred.credential_version,
                     last_rotated_at=cred.last_rotated_at,
-                ))
+                )
         except AttributeError:
             # repo does not implement list_broker_credentials yet (mock or older impl)
             pass
         except Exception as exc:  # pragma: no cover - defensive
-            # Broker credentials are supplementary. A failure here (e.g. missing
-            # broker_credentials table, DB error) must not crash /v1/user_info —
-            # the critical fields (daemon_id, user_id, permission) do not depend
-            # on broker credentials. Degrade gracefully with an empty broker list.
-            logger.warning("broker credential lookup failed; returning empty brokers: %s", exc)
-            brokers = []
+            # REQ-049, REQ-051: broker 인증정보 조회 실패는 broker=null로 graceful degrade.
+            # daemon_id, trading_enabled 필수 필드는 영향 없음.
+            logger.warning(
+                "broker credential lookup failed for daemon %s; returning broker=null: %s",
+                auth.daemon_id,
+                type(exc).__name__,
+            )
+            broker_item = None
 
     finally:
         if callable(getattr(type(repo), "close", None)):
@@ -80,7 +98,7 @@ def get_user_info(
         daemon_id=auth.daemon_id,
         trading_enabled=user.is_active,
         disabled_reason=disabled_reason,
-        brokers=brokers,
+        broker=broker_item,
         user_id=user.id,
         username=user.username,
         email=user.email,