feat(bat-053): 그날-시작 KIS 인증정보 fetch + fail-safe 로드 (REQ-112~115)

REQ-112: BrokerCredentialPayload/TradingContext 데이터클래스 + PortfolioHubReadPort.fetch_broker_credential() 포트 메서드 + hub_read 어댑터(_fetch_user_info 헬퍼 추출) + stub_read 결정론 stub
REQ-113: DaemonInstanceConfig/DaemonConfig.credential_fetch_enabled opt-in(기본 False) + TOML 파싱 + break-glass(TREX_KIS_BROKER_BREAK_GLASS) 감지
REQ-114: SnapshotScheduler._maybe_fetch_credential() — fail-closed 3조건(unavailable/broker-null/trading_disabled) + CRITICAL 알람 DAY_START_LOAD_FAILED + IntentService entry_allowed_fn 게이트(BuyIntent 차단, SellIntent 통과)
REQ-115: 그날 고정 캐시(_cached_credential/_credential_date) — 동일 날짜 재fetch 방지 + app_secret 메모리 한정(Redis 미기록)

스텁 기반 구현: 실 portfolio-hub/네트워크 없이 AC 전부 단위 테스트.
회귀: credential_fetch_enabled=False(기본) 경로 byte-for-byte 보존.
745 passed, 47 skipped (0 failed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VHtM5Ws1HKCKQ4JGi6GRb5

tests/runtime/test_instance_config.py

@@ -115,3 +115,35 @@ def test_safety_sell_enabled_true_explicit_from_toml(tmp_path, monkeypatch):
     path = _write_toml(tmp_path, 'instance_key = "i5"\nsafety_sell_enabled = true\n')
     cfg = DaemonConfig.from_config(path)
     assert cfg.safety_sell_enabled is True
+
+
+# --- credential_fetch_enabled (REQ-113 / BAT-053) ---------------------------
+
+def test_credential_fetch_enabled_default_false_from_toml(tmp_path, monkeypatch):
+    """REQ-113 AC-7: TOML에 credential_fetch_enabled 없으면 False (opt-in 기본값)."""
+    inst = DaemonInstanceConfig.from_toml(_write_toml(tmp_path, 'instance_key = "i6"\n'))
+    assert inst.credential_fetch_enabled is False
+
+
+def test_credential_fetch_enabled_false_propagates(tmp_path, monkeypatch):
+    """REQ-113 AC-1: credential_fetch_enabled=false(부재 포함) → DaemonConfig False."""
+    monkeypatch.setenv("TREX_POSTGRESQL_DSN", "postgresql://x/y")
+    cfg = DaemonConfig.from_config(_write_toml(tmp_path, 'instance_key = "i7"\n'))
+    assert cfg.credential_fetch_enabled is False
+
+
+def test_credential_fetch_enabled_true_from_toml(tmp_path, monkeypatch):
+    """REQ-113 AC-7: TOML에 credential_fetch_enabled = true → True 전파."""
+    monkeypatch.setenv("TREX_POSTGRESQL_DSN", "postgresql://x/y")
+    path = _write_toml(tmp_path, 'instance_key = "i8"\ncredential_fetch_enabled = true\n')
+    inst = DaemonInstanceConfig.from_toml(path)
+    assert inst.credential_fetch_enabled is True
+    cfg = DaemonConfig.from_config(path)
+    assert cfg.credential_fetch_enabled is True
+
+
+def test_from_env_credential_fetch_enabled_always_false(monkeypatch):
+    """REQ-113 AC-1: from_env()는 항상 credential_fetch_enabled=False(env-only 경로 보존)."""
+    monkeypatch.setenv("TREX_POSTGRESQL_DSN", "postgresql://x/y")
+    cfg = DaemonConfig.from_env()
+    assert cfg.credential_fetch_enabled is False