Hide manual trade by default, block open while running, auto-refresh auth token.

Also fix flat-side reconcile to check both long and short residuals; document in 更新说明.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/sim.py

@@ -42,6 +42,19 @@ async def sim_open_group(
     ok, reason = live_ready()
     if not get_settings().is_sim and not ok:
         raise HTTPException(status_code=400, detail=reason)
+    from ..strategy import get_engine
+
+    st = get_engine().state()
+    if st.get("running"):
+        raise HTTPException(
+            status_code=409,
+            detail="策略自动运行中，禁止手动开仓；请先暂停",
+        )
+    if not Ledger().get_setting_bool("show_manual_trade_buttons", False):
+        raise HTTPException(
+            status_code=403,
+            detail="未开启「显示手动开仓」；请在策略设置中开启后再用",
+        )
     ex = get_executor()
     if ex.has_open_position():
         raise HTTPException(status_code=409, detail="有未平仓，禁止开下一组")
@@ -115,6 +128,11 @@ async def sim_open_group(
 
 @router.post("/close-group")
 async def sim_close_group(_user: Annotated[str, Depends(require_user)]) -> dict:
+    if not Ledger().get_setting_bool("show_manual_trade_buttons", False):
+        raise HTTPException(
+            status_code=403,
+            detail="未开启「显示手动开仓」；请在策略设置中开启后再用",
+        )
     r = get_executor().close_group(reason="manual")
     if not r.ok and not r.liquidity_wait:
         raise HTTPException(status_code=400, detail=r.detail)