Enqueue a backtest.

Accepts either:

• strategy_spec: an inline strategy spec dict
• strategy_id: id of a previously saved strategy (user-scoped)

The spec is validated synchronously; a background task runs the engine and writes results to the DB.

Auth: the EFFECTIVE user is the session-cookie user when a valid session exists, else the X-Vega-Key header user (require_backtest_submitter — see auth.py). This matters because the home cockpit always sends the shared demo key alongside a real user's session cookie; without preferring the session, a logged-in account holder would be treated as the demo user and hit the free-tier cap below.