feat(backend): encrypt exchange credentials, remove IS_DEMO_MODE

- Fernet encrypt qd_exchange_credentials via SECRET_KEY (cryptography)

- Remove global read-only demo middleware; drop is_demo from auth payloads

- Egress whitelist: /api/credentials/egress-ip returns ipv4 + ipv6 (ipify)

- Exchange factory: demo/testnet URLs and OKX simulated-trading header

- Bitget spot connection test; misc route/service fixes

Made-with: Cursor

backend_api_python/env.example

@@ -9,6 +9,7 @@
 # =========================
 # Auth (required)
 # =========================
+# Also derives Fernet key for encrypting qd_exchange_credentials.encrypted_config (do not rotate casually).
 SECRET_KEY=quantdinger-secret-key-change-me
 ADMIN_USER=quantdinger
 ADMIN_PASSWORD=123456
@@ -17,7 +18,6 @@ ADMIN_EMAIL=
 # =========================
 # Core app
 # =========================
-IS_DEMO_MODE=false
 DATABASE_URL=postgresql://quantdinger:quantdinger123@postgres:5432/quantdinger
 FRONTEND_URL=http://localhost:8888
 ENABLE_REGISTRATION=true
@@ -29,6 +29,8 @@ LLM_PROVIDER=openrouter
 
 OPENROUTER_API_KEY=
 OPENROUTER_MODEL=openai/gpt-4o
+# Optional: dedicated model for AI code generation (fallback to provider default if empty)
+AI_CODE_GEN_MODEL=
 
 OPENAI_API_KEY=
 OPENAI_MODEL=gpt-4o