Risk controls, alerts, API token, more exchanges, presets

- RiskManager halts + flattens on max daily loss / drawdown, caps position
  size and trades per day; adds a manual kill switch (POST /api/bot/kill).
- Telegram and webhook notifications on trades, errors and halts.
- Optional API bearer token on /api, injected server-side by the frontend
  nginx so the browser never sees it.
- Kraken and Coinbase market data (public); Coinbase live broker. Live on an
  unsupported exchange now errors instead of silently falling back to paper.
- Strategy presets backed by the StrategyConfig table (CRUD API + UI).
- Idempotent additive-column migration so existing SQLite databases upgrade in
  place (fixes the new strategy_configs.name column).

AGENTS.md

@@ -123,6 +123,46 @@ candles you control and asserts the emitted intents. See
 - Portfolio invariant: `equity = cash ± qty * mark`, realized P&L accumulates on
   close, and every order/equity point/event is persisted.
 
+## Risk controls & notifications
+
+- `app/engine/risk.py` (`RiskManager`) tracks daily loss, drawdown, position cap
+  and trades/day. `update(equity)` only *detects* a breach and returns a reason;
+  the engine's `_halt()` makes it sticky, flattens, and stops. Keep that split —
+  it is what lets the engine close the position before halting.
+- Halt is sticky until the next `start()`. `POST /api/bot/kill` and the UI Kill
+  switch call `engine.kill()`.
+- `app/notify.py` fans out to Telegram and/or a webhook. The runtime subscribes
+  to `trade` and `error` events (see `notify_levels`) and sends them in a
+  background task. Notifications must never break trading — failures are logged
+  and swallowed. Use `RecordingNotifier` in tests (see `tests/test_notify.py`).
+- Status exposes `halted`, `halt_reason`, `trades_today`, `day_pnl`,
+  `drawdown_pct`; the dashboard renders a red banner and risk cards.
+
+## Schema changes
+
+`Base.metadata.create_all` creates missing tables but never alters existing ones,
+so deployed SQLite databases would break on a new column. When you add a
+nullable/defaulted column to an existing table, add it to `_ADDITIVE_COLUMNS` in
+`app/db.py` as `(table, column, DDL)`. `init_db()` applies these on startup
+(idempotent). Anything beyond additive changes (renames, type changes) needs a
+real migration step.
+
+## Exchanges, presets and API token
+
+- Market data adapters live in `app/market/` (Binance, Kraken, Coinbase) behind
+  `MarketData`; live brokers in `app/broker/` (Binance, Coinbase) behind
+  `Broker`. Add a venue by writing one adapter and registering it in the
+  respective `__init__.py`. Timeframes differ per venue — each adapter validates
+  and raises `ValueError` on unsupported values.
+- Kraken is market-data-only; `MODE=live` on it raises. Don't silently fall back
+  to paper for an unsupported live exchange.
+- Strategy presets use the `StrategyConfig` table via `/api/presets`; the
+  dashboard's strategy form can load/save them.
+- `API_TOKEN` guards `/api` when set (`get_guarded_runtime` dependency). The
+  frontend nginx injects it via the `API_TOKEN_HEADER` header on `/api`, and on
+  the WebSocket upgrade. `GET /api/health` is always open. When adding routes,
+  depend on `GuardedRuntimeDep`, not `RuntimeDep` (which no longer exists).
+
 ## Backtesting
 
 `app/backtest/` replays historical candles through the *same* strategy
@@ -166,14 +206,17 @@ backend/app/
   runtime.py            active engine + pub/sub fan-out to sockets
   engine/
     engine.py           trading loop, portfolio, risk
+    risk.py             RiskManager: limits, halt/kill
     portfolio.py        shared cash/P&L/sizing/risk math (engine + backtest)
     context.py -> base.py (StrategyContext) lives in strategies/base.py
     indicators.py       pure-python indicators
     strategies/         <-- add strategies here (auto-discovered)
   backtest/             historical replay + metrics
-  broker/               paper + binance brokers
-  market/               binance + fake data feeds
+  broker/               paper + binance + coinbase brokers
+  market/               binance + kraken + coinbase + fake feeds
+  notify.py             Telegram + webhook alerting
   models.py/store.py    SQLAlchemy models and persistence
+  db.py                 engine + additive column migrations
 frontend/src/           Vue dashboard (App.vue + components/)
 docker-compose.yml      production (Traefik + docker_default)
 docker-compose.local.yml  local, self-contained