Fix LIVE open/close double-book and security audit findings.

Prevent expiry dual-close from re-booking option cash, abandon ledger rejection, margin-mode mismatch, and manual close races; harden fill wait and refuse default AUTH_SECRET on LIVE.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/strategy/open_capacity.py

@@ -60,15 +60,22 @@ def _live_balances() -> dict[str, float | None]:
         "trading_usdc": None,
     }
     try:
-        from ..live.okx_funds import OkxFundsClient
+        from ..exchange.runtime import load_runtime_settings
 
-        client = OkxFundsClient()
-        try:
-            bal = client.fetch_balances()
-            out["trading_usdt"] = _f(bal.get("trading_usdt"))
-            out["trading_usdc"] = _f(bal.get("trading_usdc"))
-        finally:
-            client.close()
+        ex = str(load_runtime_settings().exchange or "").strip().lower()
+        if ex in ("binance", "bn"):
+            # 币安资金接口尚未接入；返回 None 使可开判定为「未知」而非误用 OKX
+            logger.debug("open_capacity: binance live balance not wired; treating as unknown")
+        else:
+            from ..live.okx_funds import OkxFundsClient
+
+            client = OkxFundsClient()
+            try:
+                bal = client.fetch_balances()
+                out["trading_usdt"] = _f(bal.get("trading_usdt"))
+                out["trading_usdc"] = _f(bal.get("trading_usdc"))
+            finally:
+                client.close()
     except Exception as e:
         logger.warning("open_capacity live balance failed: %s", e)
     _live_bal_cache["ts"] = now