Risk monitor

Deterministic limits, halts and rejected trades. Operator actions require the admin token and are audited.