refactor: enforce account scoped repository boundaries

docs/governance/architecture-inventory.json

@@ -265,7 +265,7 @@
     },
     {
       "path": "server.py",
-      "bytes": 267835,
+      "bytes": 267824,
       "lines": 5947
     },
     {

docs/governance/stage-09-repositories.md

@@ -0,0 +1,27 @@
+# Stage 09: Account-Scoped Repository Boundaries
+
+Date: 2026-07-29
+
+## Result
+
+- Added narrow repository ports for alerts, the trade journal, and strategy tracking.
+- Added SQLite adapters that expose only the persistence operations each service requires.
+- Required a positive account owner on every private read, write, update, and delete path.
+- Kept the shared automatic screener-run lookup explicit as the sole zero-owner read in the
+  strategy tracking adapter.
+- Routed the application container through a repository bundle.
+- Removed direct alert and trade deletion/update calls from the HTTP-facing dashboard service.
+- Preserved structural compatibility for isolated tests and gradual extraction from the legacy
+  database facade.
+
+## Boundary
+
+Application services depend on repository protocols. The SQLite implementation may later be
+replaced without changing those services. Repository adapters do not call market providers,
+and provider adapters do not access user tables.
+
+## Residual Migration
+
+The legacy `ReviewDatabase` still contains the SQL behind these adapters and remains the
+compatibility facade for features not yet extracted. Subsequent feature stages can move SQL
+behind the same ports one feature at a time after account-isolation tests pass.