fix(HEL-494): enforce datahub as sole website market boundary

Co-authored-by: multica-agent <github@multica.ai>

tests/test_data_gateway.py

@@ -12,6 +12,7 @@ from backend.data import (
     QualityEvidence,
     build_data_gateway,
 )
+from backend.data.datahub.settings import DATASETS, DatahubSettings, DatasetFlags
 from backend.data.quality import market_timezone
 
 
@@ -36,9 +37,14 @@ class DataGatewayTests(unittest.TestCase):
             policy.assert_allowed("market.level2", "unresolved", "display")
 
     def test_gateway_uses_hub_facade_and_proxies(self) -> None:
+        settings = DatahubSettings(
+            base_url="http://127.0.0.1:8766",
+            token="hub-token",
+            datasets={name: DatasetFlags(name, read=True) for name in DATASETS},
+        )
         gateway = build_data_gateway(
-            {"ifind_refresh_token": "refresh", "ifind_access_token": "access"},
-            lambda: "must-not-be-used",
+            {},
+            datahub_settings=settings,
         )
         client = gateway.tushare()
         self.assertEqual(client.token, "datahub")
@@ -63,7 +69,7 @@ class DataGatewayTests(unittest.TestCase):
             / "market"
             / "service.py"
         ).read_text(encoding="utf-8")
-        self.assertEqual(source.count("TushareClient(self.token)"), 1)
+        self.assertNotIn("TushareClient(self.token)", source)
         self.assertIn("return gateway.tushare()", source)
 
     def test_provider_construction_has_unique_declared_owners(self) -> None:
@@ -71,7 +77,7 @@ class DataGatewayTests(unittest.TestCase):
         owners = {
             "IfindProvider": {"backend/data/gateway.py"},
             "MarketChartClient": {"backend/data/gateway.py"},
-            "TushareClient": {"backend/features/market/service.py"},
+            "TushareClient": set(),
             "DatahubClient": {"backend/data/gateway.py"},
             "DatahubAwareTushareClient": {"backend/data/gateway.py"},
             "DatahubBridge": {"backend/data/gateway.py"},