feat(bat-053): 그날-시작 KIS 인증정보 fetch + fail-safe 로드 (REQ-112~115)

REQ-112: BrokerCredentialPayload/TradingContext 데이터클래스 + PortfolioHubReadPort.fetch_broker_credential() 포트 메서드 + hub_read 어댑터(_fetch_user_info 헬퍼 추출) + stub_read 결정론 stub
REQ-113: DaemonInstanceConfig/DaemonConfig.credential_fetch_enabled opt-in(기본 False) + TOML 파싱 + break-glass(TREX_KIS_BROKER_BREAK_GLASS) 감지
REQ-114: SnapshotScheduler._maybe_fetch_credential() — fail-closed 3조건(unavailable/broker-null/trading_disabled) + CRITICAL 알람 DAY_START_LOAD_FAILED + IntentService entry_allowed_fn 게이트(BuyIntent 차단, SellIntent 통과)
REQ-115: 그날 고정 캐시(_cached_credential/_credential_date) — 동일 날짜 재fetch 방지 + app_secret 메모리 한정(Redis 미기록)

스텁 기반 구현: 실 portfolio-hub/네트워크 없이 AC 전부 단위 테스트.
회귀: credential_fetch_enabled=False(기본) 경로 byte-for-byte 보존.
745 passed, 47 skipped (0 failed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VHtM5Ws1HKCKQ4JGi6GRb5

trex_core/application/portfolio.py

@@ -77,8 +77,36 @@ class RealizedPnlResult:
     total_realized_pnl: float
 
 
+# ---------------------------------------------------------------- broker credential (REQ-112)
+
+@dataclass(frozen=True)
+class BrokerCredentialPayload:
+    """KIS broker credential fetched from portfolio-hub (REQ-112).
+
+    Carries app_key/app_secret/account_ref for KIS API authentication.
+    credential_version is optional (portfolio-hub versioning, informational only).
+    NFR-2: app_secret must never be logged in plaintext.
+    """
+    account_ref: str
+    app_key: str
+    app_secret: str
+    credential_version: Optional[int] = None
+
+
+@dataclass(frozen=True)
+class TradingContext:
+    """Combined broker credential + trading_enabled flag from /v1/user_info (REQ-112).
+
+    Returned by fetch_broker_credential() in a single atomic read to avoid
+    double HTTP calls.
+    """
+    broker: Optional[BrokerCredentialPayload]
+    trading_enabled: bool
+
+
 class PortfolioHubReadPort(Protocol):
-    """Read-side contract for portfolio-hub universe (REQ-027) + realized PnL (REQ-109)."""
+    """Read-side contract for portfolio-hub universe (REQ-027) + realized PnL (REQ-109)
+    + broker credential (REQ-112)."""
 
     def get_portfolios(self, daemon_id: str) -> list[PortfolioItem]:
         """Return all portfolios where `managed_by_daemon_id == daemon_id`."""
@@ -117,6 +145,21 @@ class PortfolioHubReadPort(Protocol):
         """
         ...
 
+    def fetch_broker_credential(self) -> "TradingContext":
+        """GET /v1/user_info — broker credential + trading_enabled (REQ-112).
+
+        Returns a TradingContext with:
+          - broker: BrokerCredentialPayload if the daemon has assigned credentials,
+            None if broker is null (no credential assigned) or credential_payload
+            is null (decryption failure).
+          - trading_enabled: bool as reported by portfolio-hub.
+
+        Raises:
+            PortfolioHubUnavailableError: on network error, non-2xx (incl. 403),
+                                          or JSON parse failure.
+        """
+        ...
+
 
 class DegradedReason(str, Enum):
     """Machine-readable degraded reason codes (REQ-028 AC-2, dcy-005 OQ-5)."""