Add SIM/LIVE switch with API keys saved to .env and OKX live executor.

Enable settings UI for mode/keys, gate strategy start when LIVE is not ready, and stop PM2 from forcing MODE=SIM.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_runtime_mode.py

@@ -0,0 +1,79 @@
+"""SIM/LIVE 运行时闸门与脱敏。"""
+
+from app.env_store import live_ready, mask_secret, okx_keys_configured
+
+
+def test_mask_secret() -> None:
+    assert mask_secret(None) is None
+    assert mask_secret("") is None
+    assert mask_secret("abcd") == "****"
+    m = mask_secret("abcdefghij")
+    assert m is not None
+    assert m.endswith("ghij")
+    assert m.startswith("*")
+
+
+def test_live_ready_sim(monkeypatch) -> None:
+    import app.env_store as es
+
+    class S:
+        mode = "SIM"
+        is_sim = True
+        okx_api_key = ""
+        okx_api_secret = ""
+        okx_api_passphrase = ""
+        binance_api_key = ""
+        binance_api_secret = ""
+
+    monkeypatch.setattr(es, "get_settings", lambda: S())
+    ok, reason = live_ready(exchange="okx")
+    assert ok is True
+    assert reason == "sim"
+
+
+def test_live_ready_okx_missing_keys(monkeypatch) -> None:
+    import app.env_store as es
+
+    class S:
+        mode = "LIVE"
+        is_sim = False
+        okx_api_key = ""
+        okx_api_secret = ""
+        okx_api_passphrase = ""
+        binance_api_key = ""
+        binance_api_secret = ""
+
+    monkeypatch.setattr(es, "get_settings", lambda: S())
+    ok, reason = live_ready(exchange="okx")
+    assert ok is False
+    assert "OKX" in reason
+
+
+def test_live_ready_binance_stub(monkeypatch) -> None:
+    import app.env_store as es
+
+    class S:
+        mode = "LIVE"
+        is_sim = False
+        okx_api_key = "k"
+        okx_api_secret = "s"
+        okx_api_passphrase = "p"
+        binance_api_key = "bk"
+        binance_api_secret = "bs"
+
+    monkeypatch.setattr(es, "get_settings", lambda: S())
+    ok, reason = live_ready(exchange="binance")
+    assert ok is False
+    assert "尚未接入" in reason
+
+
+def test_okx_keys_configured(monkeypatch) -> None:
+    import app.env_store as es
+
+    class S:
+        okx_api_key = "k"
+        okx_api_secret = "s"
+        okx_api_passphrase = "p"
+
+    monkeypatch.setattr(es, "get_settings", lambda: S())
+    assert okx_keys_configured() is True