feat: multiple updates - alerts, auth, sectors, rotation service, financials ingestion, task specs, and agent framework

tasks/alert-service-cleanup/SPEC.md

@@ -0,0 +1,37 @@
+# Task: Cleanup alert router — remove DB calls, consolidate
+
+## Goal
+Remove all remaining direct database calls from `routers/alerts.py`. The router should now be a thin HTTP layer only.
+
+## Requirements
+
+### Changes to `src/backend/routers/alerts.py`
+
+1. Remove direct imports of `execute_query`, `execute_command`, `execute_one` from `database`
+2. Remove the `_require_watchlist_owner()` helper function (moved to AlertService)
+3. Ensure all endpoints use `AlertService` exclusively
+4. The router should only contain:
+   - Route decorators and signatures
+   - Auth extraction (`current_user["id"]`)
+   - Service method calls
+   - Response model wrapping
+5. The file should be ~60-80 lines (down from ~200+)
+
+### Service layer additions if needed
+If AlertService is missing a helper method the router needs, add it:
+- `build_watchlist_in_clause(user_id)` — returns (placeholders, params) for user's watchlists
+- Any other query helper needed by the listing endpoint
+
+## Acceptance Criteria
+1. `routers/alerts.py` has no direct `execute_query`/`execute_command`/`execute_one` calls
+2. File is under 100 lines
+3. All alert tests still pass: `pytest tests/test_alerts.py --tb=short`
+4. No import errors
+
+## Files to Modify
+- `src/backend/routers/alerts.py`
+- `src/backend/services/alert_service.py` (if new helpers needed)
+
+## Files to Read First
+- `src/backend/routers/alerts.py` — current state
+- `src/backend/services/alert_service.py` — current service