Add single-leg option order support (buy-to-open, sell-to-close)

[IamJasonBian]

Summary

Adds option-order placement to allocation-engine. Until now, SafeCashBot only placed stock orders; option support was read-only. This PR adds two single-leg methods plus a CLI wrapper, so the engine can run buy-and-bracket workflows (entry buy-limit + take-profit sell-limit) on equity options through Robinhood (robin-stocks).

New methods on SafeCashBot

bot.place_option_buy_limit_order(
    symbol='XLY', expiration='2026-09-18', strike=120.0,
    option_type='call', quantity=1, price=4.50, dry_run=True
)

bot.place_option_sell_limit_order(
    symbol='XLY', expiration='2026-09-18', strike=120.0,
    option_type='call', quantity=1, price=6.75, dry_run=True
)

Both follow the existing place_cash_buy_order / place_sell_order pattern: dry-run default, account-locked to RH_AUTOMATED_ACCOUNT_NUMBER, banner logging, and pre-trade validation.

• Buy validates buying power covers quantity * price * 100
• Sell (close) validates the contract is currently held (matches chain_symbol, expiration_date, strike_price, type)
• Single-leg only — no spreads/multi-leg

New CLI

# Dry run
python scripts/place_option_order.py XLY 2026-09-18 120 call 1 4.75 buy

# Live entry
python scripts/place_option_order.py XLY 2026-09-18 120 call 1 4.75 buy --live

# Live take-profit (must already hold the contract)
python scripts/place_option_order.py XLY 2026-09-18 120 call 1 7.10 sell --live

Motivation

The allocation-gym variance-Kelly framework recommends 3M ATM option overlays (see allocation-gym docs/12 buy_recommendations_2026_05). Without programmatic option entry, all option trades had to be placed manually in the RH app. This unlocks scripted execution of the same buy-and-bracket pattern that produced the +57% / +103% IWN-put round-trips in docs/9/ytd_performance.

Test plan

• python -m py_compile clean on both files
• Dry-run signature matches existing CLI pattern (scripts/place_single_order.py)
• Live single-contract dry-run on a real RH session (requires interactive MFA — must be run by operator with phone access)
• Live paper validation (one-contract test) before scaling