Final review fixes: scrub tracked credentials, trim scannable TFs, absolute parity pin, scanning type-checks

Claude-Session: https://claude.ai/code/session_01VPNF37MP9Kuv62B1VBrZ1b

test_all.py

@@ -2630,6 +2630,8 @@ def _():
         {"scanning": {"pairs": ["EUR/USD"]}},                     # unknown pair
         {"scanning": {"timeframes": ["M7"]}},                     # bad TF name
         {"scanning": {"timeframes": ["W1"]}},                     # unscannable TF
+        {"scanning": {"pairs": 5}},                               # pairs not a list
+        {"scanning": {"timeframes": 5}},                          # timeframes not a list
         {"data_providers": {"active": "polygon",
                             "twelve_data": {"api_key": "k"}}},    # no block
         {"telegram": {"alert_min_quality": "Z"}},                 # bad quality
@@ -2803,6 +2805,17 @@ def _():
         assert "credentials" in str(e)
 
 
+@test("app_config: absolute parity — default overlay leaves tuned values untouched")
+def _():
+    from pair_signals import PAIR_PRODUCERS
+    cfg = PAIR_PRODUCERS[XAUUSD](Timeframe.H1, None)
+    assert cfg.xau_strategy.blocked_hours_utc == [0, 1, 2, 10, 11, 13, 16, 21]
+    assert cfg.backtest.blocked_hours_utc == [0, 1, 2, 10, 11, 13, 16, 21]
+    assert cfg.scan_pairs == [XAUUSD]
+    assert cfg.scan_timeframes == [Timeframe.M5, Timeframe.M15,
+                                   Timeframe.H1, Timeframe.H4]
+
+
 # ══════════════════════════════════════════════════════════════════════
 #  SUMMARY
 # ══════════════════════════════════════════════════════════════════════