Risk controls, alerts, API token, more exchanges, presets

- RiskManager halts + flattens on max daily loss / drawdown, caps position
  size and trades per day; adds a manual kill switch (POST /api/bot/kill).
- Telegram and webhook notifications on trades, errors and halts.
- Optional API bearer token on /api, injected server-side by the frontend
  nginx so the browser never sees it.
- Kraken and Coinbase market data (public); Coinbase live broker. Live on an
  unsupported exchange now errors instead of silently falling back to paper.
- Strategy presets backed by the StrategyConfig table (CRUD API + UI).
- Idempotent additive-column migration so existing SQLite databases upgrade in
  place (fixes the new strategy_configs.name column).

.env.example

@@ -33,6 +33,30 @@ EXCHANGE_API_SECRET=
 # Set true for testnet/sandbox where supported
 EXCHANGE_SANDBOX=false
 
+# --- Risk controls (0 disables a limit) ---
+# Halt + flatten if the day's loss reaches this amount in quote currency
+MAX_DAILY_LOSS=0
+# Halt + flatten if equity falls this percent from its peak
+MAX_DRAWDOWN_PCT=0
+# Cap a single position at this fraction of equity (1.0 = all-in)
+MAX_POSITION_PCT=1.0
+# Max new entries per UTC day (0 = unlimited)
+MAX_TRADES_PER_DAY=0
+
+# --- API token (optional) ---
+# When set, /api requires this token. The frontend nginx injects it server-side,
+# so the browser never sees it. Leave empty to disable.
+API_TOKEN=
+API_TOKEN_HEADER=X-API-Token
+
+# --- Notifications (optional) ---
+# Telegram: message @BotFather to create a bot, then get the chat id from
+# https://api.telegram.org/bot<token>/getUpdates after messaging the bot.
+TELEGRAM_BOT_TOKEN=
+TELEGRAM_CHAT_ID=
+# Generic webhook: receives POST {"level": "...", "text": "..."}
+NOTIFY_WEBHOOK_URL=
+
 # --- Web ---
 # Comma separated list, or * in dev
 CORS_ORIGINS=*