Lock hedge-plan option selection to ITM/ATM (perp) and ATM/OTM (OO).

Server validate on preview/start, UI filters and recommend templates, plus usability/security audit doc.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/env/env_ui_manifest.py

@@ -188,6 +188,21 @@ _HEDGE_PO_FIELDS: list[tuple[str, str, str]] = [
     ("HEDGE_PLAN_OPEN_ORDER", "永期开仓顺序", "options_first 或 perp_first"),
     ("HEDGE_PLAN_ON_PERP_SL_CLOSE_OPTIONS", "永期止损后强制平期权", "保护机制,建议保持 true"),
     ("HEDGE_PLAN_ON_PERP_TP_CLOSE_OPTIONS", "永期止盈后强制平期权", "默认 false,保险腿不平"),
+    (
+        "HEDGE_PLAN_ITM_MAX_DIST_USD",
+        "永期实值最大深度(U)",
+        "默认空=沿用 OKX_OPTIONS_ITM_MAX_DIST_USD(常 30);0=不限制",
+    ),
+    (
+        "HEDGE_PLAN_MIN_OPTION_HOURS",
+        "对冲期权最低剩余小时",
+        "默认 8;测算/启动时若传 hours_to_expiry 则校验",
+    ),
+    (
+        "HEDGE_PLAN_MIN_OPTION_LEVERAGE",
+        "对冲期权最低杠杆(S/ask)",
+        "默认 0=不启用;>0 时拒绝杠杆过低的保险腿",
+    ),
 ]
 
 _HEDGE_OO_FIELDS: list[tuple[str, str, str]] = [