Final review fixes: scrub tracked credentials, trim scannable TFs, absolute parity pin, scanning type-checks

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VPNF37MP9Kuv62B1VBrZ1b

app_config.py

@@ -37,8 +37,9 @@ CONFIG_PATH = os.path.join(
 
 _VALID_QUALITIES = ("A+", "A", "B", "C")
 _VALID_LOG_LEVELS = ("DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL")
-# Timeframes the bot's candle-boundary scheduler can run (W1 has no loop).
-_SCANNABLE_TFS = ("M5", "M15", "M30", "H1", "H4", "D1")
+# Timeframes the bot's candle-boundary scheduler supports (must have
+# AUTOSCAN_CONFIRMATIONS entries in telegram_bot.py).
+_SCANNABLE_TFS = ("M5", "M15", "H1", "H4")
 
 _KNOWN_TOP = {"telegram", "data_providers", "scanning", "pairs", "log_level"}
 _KNOWN_TELEGRAM = {"token", "chat_id", "channel_id", "alert_min_quality"}
@@ -127,6 +128,8 @@ def load_app_config(path: str = CONFIG_PATH) -> AppConfig:
     _check_keys(scanning, _KNOWN_SCANNING, '"scanning"')
     if "pairs" in scanning:
         pairs = scanning["pairs"]
+        if not isinstance(pairs, list):
+            raise AppConfigError('config.json: scanning.pairs must be a list')
         bad = [p for p in pairs if p not in PAIR_INFO]
         if bad:
             raise AppConfigError(
@@ -135,6 +138,9 @@ def load_app_config(path: str = CONFIG_PATH) -> AppConfig:
         app.scan_pairs = list(pairs)
     if "timeframes" in scanning:
         names = scanning["timeframes"]
+        if not isinstance(names, list):
+            raise AppConfigError(
+                'config.json: scanning.timeframes must be a list')
         bad = [n for n in names if n not in _SCANNABLE_TFS]
         if bad:
             raise AppConfigError(