feat(#520): opt-in live XMR/XTM price feed over Tor + fiat estimates on the earnings card

[VijitSingh97]

Closes #651 (the tracking issue for the deferred auto half). Refs #520 (closed by #614 with the static half).

What

• dashboard.energy.price_feed (default false): fetch the XMR + XTM spot prices live from CoinGecko in the operator's currency, replacing the static xmr_price/tari_price numbers. New service/price_feed.py follows the Dashboard: "new release available" badge linking to the GitHub release (notify-only, no upgrade) #224 update-checker shape: 15-min self-throttle, fail-silent, keeps the last good prices on failure; the static config prices are the fallback until the first fetch lands. CoinGecko is the one keyless source quoting both coins in a single call (CoinDesk has no XTM; Yahoo has no stable free JSON API); Tari's CoinGecko id is minotari, verified live.
• The calculator states which price it's using (Energy calc: XMR + Tari prices (static + opt-in auto over Tor) so net profit covers p2pool + XvB + Tari #520's honesty bar): a Prices: footer on the earnings card — XMR USD 333.97 · XTM USD 0.000400 — live from CoinGecko over Tor, updated 12m ago / static, set in config.json / feed-waiting. build_energy publishes price_source provenance.
• Fiat estimates on the coin tabs: Monero gets ≈/day/month/year, Tari ≈ per block + ≈/day, XvB a fiat mirror of the tier expected/cost/net line — same visibility guards as the coin figures, never a fabricated number. Tiny XTM prices keep precision (formatFiatPrice, no "USD 0.00").

Privacy (#160/#270/#520 constraints)

• Opt-in, default off — the appliance never dials CoinGecko unbidden.
• Always over the bridge Tor SOCKS (socks5h, same route as the update check / XvB stats) — CoinGecko sees a Tor exit, never the host IP. No clearnet branch exists.
• The new egress appears honestly in the Dashboard: Component Health panel with per-component + outbound-connection security status (Tor vs clearnet) #170 egress posture + Stack Topology (TOR when on, INACTIVE otherwise) and in the privacy.md runtime-egress table.

Hardening (from the security-review pass)

• parse_prices rejects non-finite values: json.loads accepts NaN/Infinity tokens and NaN <= 0 is False, so a hostile response could otherwise push invalid JSON into /api/state and stall the whole dashboard.
• The currency label (free-form printable ASCII, dashboard-committable via [Feature] Set electricity cost (dashboard.energy) from the dashboard, not just config.json #504) must be plainly alphabetic ([A-Za-z]{2,5}) before it may leave the host as a query parameter — a committed label can't become an exfil channel through the feed URL. Anything else: no request, static fallback.
• Known residual (pre-existing pattern shared with the update checker / XvB client): no response-size cap on the fetch. Worth a shared fix in a follow-up.

Tests

• Unit: test_price_feed.py (parse incl. NaN/exfil guards, Tor proxying, throttle/fallback), config loader, build_energy price-source matrix, egress posture, _sync_prices.
• Frontend: coinFiat/formatFiatPrice/priceSourceLabel units + EarningsCard render tests for the fiat rows and provenance line (203 pass).
• Stack: pithead validate_energy_config gains price_feed cases (boolean-only rejection, closed-schema key list, valid block applies).
• Fixture drift fixed at the root: _gen_state.py now gives its workers real power data, so the frontend fixture regenerates honestly instead of the hand-edited energy block feat(#520): fold Tari revenue into the energy/profit net calculation #614 left behind.
• make lint / make test / make test-patch-coverage (90%) all green; adversarial verifier pass clean; ponytail review applied (dropped an unused constructor knob).

Docs

configuration.md (new key + amended price rows), dashboard.md (price sources + fiat rows), privacy.md (egress table row), README feature bullet, and every stale "no price feed ships" claim removed (code docstrings, UI hint, pithead comment).

Follow-up candidates: response-size cap shared across the three external HTTP clients; price_feed editability from the dashboard config editor (needs the #504 editable-keys treatment).

🤖 Generated with Claude Code

[VijitSingh97]

Review record (in-session, second pass on top of the authoring session's verifier/security/ponytail runs): read the egress core myself — parse_prices non-finite gate and the currency exfil-guard regex are real and correctly ordered before the URL; the price-feed egress row sits under the (host-networked) dashboard component and the topology carries it; pithead's closed-schema key list + boolean validation extend correctly, config.reference.json keeps the superset invariant. Rebased onto post-v1.9.0 develop: the fixture-generator conflict with #642 is resolved by merging BOTH changes (raffle win + enriched power blocks) and regenerating state.json from the generator — 208/208 frontend, full make test green, patch coverage 98%. Tracking issue #651 filed and linked (the deferred auto half of #520 had none). Known residual (response-size cap shared with the update-checker/XvB clients) stays a follow-up. Rides v1.9.1.