chore: follow-ups from the comment sweep #227

The comment sweep (branches refactor/no-comments-src-shared, refactor/no-comments-analysis, refactor/no-comments-tooling) fixed the root cause behind each deleted comment where it could. These are left.

Needs an owner decision:

• hedge_comparison.SQQQ_EXPENSE_RATIO (0.95%) relied on a fee waiver through 2026-09-30. The value needs a current source. SQQQ_EXPENSE_RATIO_AS_OF and SQQQ_FEE_WAIVER_THROUGH now record the dates.
• HedgeConfig.roll_window_days exists, but rolling_tracker uses a fixed ROLL_WINDOW_DAYS per an earlier locked decision. Decide whether config drives it.

Code work:

• Remove the relaxed [[tool.mypy.overrides]] block in pyproject.toml. Today that surfaces 84 errors in 22 files.
• The DR-1 to DR-4 tests in test_compliance_officer_itc_integration.py compare fixed numbers to fixed numbers. They need a typed decision function in code to test against.
• PortfolioLoader.load_latest still returns None on an unreadable CSV, so the app says not found. Let the ValueError reach app.py, which already handles it.
• TechnicalScreener.screen_tickers still catches every exception per ticker and prints.
• setup.sh checks python3 directly, so test_setup_onboarding_integration.sh keeps a python3.12 PATH override. Check the interpreter through uv.
• scripts/onboarding/index.ts main is a stub that full-setup.test.ts and summary.ts still call. Wire the real wizard or remove it.
• Name the remaining magic numbers in test_backtester.py, test_total_return.py, test_options.py, test_options_chain.py (expiries from a DTE list), test_correlation.py, and test_itc_risk.py.