feat(V2): Deribit credenziali per env (CLIENT_ID/SECRET _TESTNET / _LIVE)

DeribitSettings ora supporta coppie credenziali distinte per testnet e
mainnet via DERIBIT_CLIENT_ID_TESTNET/_LIVE e DERIBIT_CLIENT_SECRET_TESTNET/_LIVE.
Le coppie env-specifiche prevalgono sulla coppia base
DERIBIT_CLIENT_ID/DERIBIT_CLIENT_SECRET (mantenuta per backward compat).

build_client risolve la coppia giusta tramite settings.deribit.credentials(env);
ValueError esplicito se nessuna coppia configurata per l'env richiesto.

+4 test (legacy single, per-env, override, missing). Fix anche isolation
da .env reale via monkeypatch.chdir(tmp_path).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/cerbero_mcp/exchanges/__init__.py

@@ -15,9 +15,10 @@ async def build_client(
         from cerbero_mcp.exchanges.deribit.client import DeribitClient
 
         url = settings.deribit.url_testnet if env == "testnet" else settings.deribit.url_live
+        cid, csec = settings.deribit.credentials(env)
         return DeribitClient(
-            client_id=settings.deribit.client_id,
-            client_secret=settings.deribit.client_secret.get_secret_value(),
+            client_id=cid,
+            client_secret=csec,
             testnet=(env == "testnet"),
             base_url_override=url,
         )

src/cerbero_mcp/settings.py

@@ -21,12 +21,33 @@ class DeribitSettings(_Sub):
         env_prefix="DERIBIT_",
         extra="ignore",
     )
-    client_id: str
-    client_secret: SecretStr
+    client_id: str | None = None
+    client_secret: SecretStr | None = None
+    client_id_testnet: str | None = None
+    client_secret_testnet: SecretStr | None = None
+    client_id_live: str | None = None
+    client_secret_live: SecretStr | None = None
     url_live: str
     url_testnet: str
     max_leverage: int = 3
 
+    def credentials(self, env: str) -> tuple[str, str]:
+        """Return (client_id, client_secret) for the given env.
+        Prefers env-specific (_TESTNET / _LIVE) pair; falls back to base
+        (DERIBIT_CLIENT_ID / DERIBIT_CLIENT_SECRET) for legacy single-pair setups.
+        """
+        if env == "testnet":
+            cid = self.client_id_testnet or self.client_id
+            csec = self.client_secret_testnet or self.client_secret
+        elif env == "mainnet":
+            cid = self.client_id_live or self.client_id
+            csec = self.client_secret_live or self.client_secret
+        else:
+            raise ValueError(f"unknown deribit env: {env}")
+        if not cid or csec is None:
+            raise ValueError(f"Deribit credentials not configured for env={env}")
+        return cid, csec.get_secret_value()
+
 
 class BybitSettings(_Sub):
     model_config = SettingsConfigDict(