Lock hedge-plan option selection to ITM/ATM (perp) and ATM/OTM (OO).

Server validate on preview/start, UI filters and recommend templates, plus usability/security audit doc.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/hedge_plan/hedge_plan_register.py

@@ -891,6 +891,8 @@ def register_hedge_plan_routes(app: Flask, cfg: dict[str, Any]) -> None:
 
 
 def _preview_po(body: dict[str, Any]) -> dict[str, Any]:
+    from lib.hedge_plan.hedge_plan_moneyness_lib import validate_po_option_moneyness
+
     direction = str(body.get("direction") or "long").lower()
     entry = float(body["entry"])
     tp = float(body["tp"])
@@ -908,6 +910,16 @@ def _preview_po(body: dict[str, Any]) -> dict[str, Any]:
             raise ValueError("缺少权利金或卖一价")
         premium = option_premium_total(ask=float(ask), sheets=sheets, ct_mult=ct_mult)
     index_px = body.get("index_px")
+    idx_for_money = float(index_px) if index_px is not None else entry
+    money_err = validate_po_option_moneyness(
+        opt_type=opt_type,
+        strike=strike,
+        index_px=idx_for_money,
+        ask=ask,
+        hours_to_expiry=body.get("hours_to_expiry"),
+    )
+    if money_err:
+        raise ValueError(money_err)
     return build_perp_options_preview(
         direction=direction,
         entry=entry,
@@ -925,6 +937,8 @@ def _preview_po(body: dict[str, Any]) -> dict[str, Any]:
 
 
 def _preview_oo(body: dict[str, Any]) -> dict[str, Any]:
+    from lib.hedge_plan.hedge_plan_moneyness_lib import validate_oo_legs_moneyness
+
     up = body.get("target_price_up")
     down = body.get("target_price_down")
     legacy = body.get("target_price")
@@ -952,6 +966,9 @@ def _preview_oo(body: dict[str, Any]) -> dict[str, Any]:
             )
         if leg.get("premium_paid") is None:
             raise ValueError(f"缺少 {name} 权利金")
+    money_err = validate_oo_legs_moneyness(leg_a, leg_b, index_px=index_px)
+    if money_err:
+        raise ValueError(money_err)
     return build_options_options_preview(
         target_price_up=up_f,
         target_price_down=down_f,