Final review fixes: scrub tracked credentials, trim scannable TFs, absolute parity pin, scanning type-checks

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VPNF37MP9Kuv62B1VBrZ1b

docs/superpowers/plans/2026-07-21-centralized-config.md

@@ -644,7 +644,7 @@ Expected: `✗ config.py: hardcoded twelve_data_api_key field is gone` (plus the
 
 - [ ] **Step 3: Implement**
 
-`config.py`: delete line 346 (`twelve_data_api_key: str = "f563b22ffdfd4924955decbe1a8c8701"`).
+`config.py`: delete line 346 (`twelve_data_api_key: str = "<TWELVE_DATA_API_KEY>"`).
 
 `data_provider.py` — add to the local imports:
 
@@ -910,14 +910,14 @@ These are the exact values being deleted from source (from pre-change `telegram_
 cat > /home/harwinder/Development/ForexBot2/config.json <<'EOF'
 {
   "telegram": {
-    "token": "8228251480:AAFW2OAyQ2idMicql2t_CIXk1r9-qfRTfNE",
-    "chat_id": "6025899022",
-    "channel_id": "-1003942265371",
+    "token": "<TELEGRAM_BOT_TOKEN>",
+    "chat_id": "<OWNER_CHAT_ID>",
+    "channel_id": "<CHANNEL_ID>",
     "alert_min_quality": "C"
   },
   "data_providers": {
     "active": "twelve_data",
-    "twelve_data": { "api_key": "f563b22ffdfd4924955decbe1a8c8701" }
+    "twelve_data": { "api_key": "<TWELVE_DATA_API_KEY>" }
   },
   "scanning": {
     "pairs": ["XAU/USD"],
@@ -932,6 +932,8 @@ EOF
 git status --short   # config.json must NOT appear (gitignored)
 ```
 
+(Real values were scrubbed from this doc 2026-07-21 — take them from the previously deployed telegram_bot.py/config.py in git history, and rotate both credentials after merge.)
+
 - [ ] **Step 2: Boot smoke test (no network needed)**
 
 ```bash