feat(bat-053): 그날-시작 KIS 인증정보 fetch + fail-safe 로드 (REQ-112~115)

REQ-112: BrokerCredentialPayload/TradingContext 데이터클래스 + PortfolioHubReadPort.fetch_broker_credential() 포트 메서드 + hub_read 어댑터(_fetch_user_info 헬퍼 추출) + stub_read 결정론 stub
REQ-113: DaemonInstanceConfig/DaemonConfig.credential_fetch_enabled opt-in(기본 False) + TOML 파싱 + break-glass(TREX_KIS_BROKER_BREAK_GLASS) 감지
REQ-114: SnapshotScheduler._maybe_fetch_credential() — fail-closed 3조건(unavailable/broker-null/trading_disabled) + CRITICAL 알람 DAY_START_LOAD_FAILED + IntentService entry_allowed_fn 게이트(BuyIntent 차단, SellIntent 통과)
REQ-115: 그날 고정 캐시(_cached_credential/_credential_date) — 동일 날짜 재fetch 방지 + app_secret 메모리 한정(Redis 미기록)

스텁 기반 구현: 실 portfolio-hub/네트워크 없이 AC 전부 단위 테스트.
회귀: credential_fetch_enabled=False(기본) 경로 byte-for-byte 보존.
745 passed, 47 skipped (0 failed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VHtM5Ws1HKCKQ4JGi6GRb5

trex_core/runtime/config.py

@@ -158,6 +158,10 @@ class DaemonInstanceConfig:
     # back to env TREX_WATCHDOG_TIMEOUT (default 120). Long-term instances
     # polling every 1-10 min should set >= 1800 so expired stays meaningful.
     watchdog_timeout_sec: Optional[int] = None
+    # dcy-036 / REQ-113: opt-in portfolio-hub credential fetch. False (default)
+    # = env-only KIS config (byte-for-byte backward compat). True = fetch 1st,
+    # TREX_KIS_BROKER_BREAK_GLASS=true = skip fetch and use env.
+    credential_fetch_enabled: bool = False
 
     @staticmethod
     def from_toml(path: str) -> "DaemonInstanceConfig":
@@ -196,6 +200,7 @@ class DaemonInstanceConfig:
             default_order_timeout_sec=default_timeout,
             safety_sell_enabled=bool(data.get("safety_sell_enabled", True)),
             watchdog_timeout_sec=watchdog_timeout,
+            credential_fetch_enabled=bool(data.get("credential_fetch_enabled", False)),
         )
 
 
@@ -242,6 +247,10 @@ class DaemonConfig:
     ledger_retry_base_sec: float = 1.0
     ledger_retry_cap_sec: float = 300.0
     ledger_max_attempts: int = 8
+    # dcy-036 / REQ-113: opt-in portfolio-hub credential fetch. False (default)
+    # = env-only KIS config (byte-for-byte backward compat). True = fetch 1st,
+    # TREX_KIS_BROKER_BREAK_GLASS=true env = skip fetch and use env instead.
+    credential_fetch_enabled: bool = False
 
     @staticmethod
     def from_env() -> "DaemonConfig":
@@ -367,4 +376,5 @@ class DaemonConfig:
             max_active_slots=inst.max_active_slots,
             safety_sell_enabled=inst.safety_sell_enabled,
             safety_sell=safety_sell,
+            credential_fetch_enabled=inst.credential_fetch_enabled,
         )