Add web dashboard (Redis + FastAPI + WebSocket), scope XAU penalties

Signal daemon (signal_web.py): candle-boundary scanner mirroring
telegram_bot.py, publishes serialized SignalReport JSON to Redis.
Web API (web/app.py): thin FastAPI reader behind Apache, serves
/api/signals REST + /ws WebSocket from Redis pub/sub.
Frontend (web/static/index.html): 3-pair grid, color-coded signals,
indicator breakdown per timeframe, trade setup display.

Also: XAU-specific penalty scoping in signal_aggregator (softer
confidence penalties for gold, original strict values for forex),
pair-aware session filter routing XAU to its own blocked hours.

test_all.py

@@ -172,7 +172,7 @@ def _():
 def _():
     sc = SignalConfig()
     assert sc.min_confidence == 55.0
-    assert sc.min_rr_ratio == 1.2
+    assert sc.min_rr_ratio == 0.5
     assert sc.atr_sl_multiplier == 1.5
     assert sc.default_rr_ratio == 2.0
     assert sc.cooldown_bars == 5
@@ -198,7 +198,9 @@ def _():
 def _():
     xc = XauStrategyConfig()
     assert xc.enabled is True
-    assert xc.rsi_entry_threshold == 38.0
+    assert xc.rsi_entry_threshold == 45.0
+    assert xc.min_ema200_tfs == 2
+    assert xc.allow_generic_trades is True
     assert xc.tp_atr_multiplier == 0.9
     assert xc.sl_atr_multiplier == 2.0
     assert isinstance(xc.blocked_hours_utc, list)
@@ -1123,6 +1125,9 @@ def _():
     config = PlatformConfig()
     config.backtest.session_filter = True
     config.backtest.blocked_hours_utc = list(range(24))  # block all hours
+    config.eur_strategy.enabled = False
+    config.gbp_strategy.enabled = False
+    config.xau_strategy.enabled = False
     agg = SignalAggregator(config)
     dfs = {
         Timeframe.H1: make_ohlcv(300, seed=42),