Separate Demo and Real identities, credentials, routes and resources

[carndog]

Outcome

Make it technically difficult for a demo workflow or deployment mistake to reach the Real trading route.

Acceptance criteria

• Use separate Demo and Real application identities
• Use separate Key Vault secrets and least-privilege access
• Use separate execution routes/queues and configuration
• Prevent PriceGatherer, StrategyEvaluator, and the Demo executor from reading Real credentials
• Require an explicit deployment/environment choice for Real components
• Add tests and policy checks that reject mixed Demo/Real configuration
• Provide independent kill switches and telemetry dimensions
• Document credential rotation, revocation, and incident response