Risk controls, alerts, API token, more exchanges, presets

- RiskManager halts + flattens on max daily loss / drawdown, caps position
  size and trades per day; adds a manual kill switch (POST /api/bot/kill).
- Telegram and webhook notifications on trades, errors and halts.
- Optional API bearer token on /api, injected server-side by the frontend
  nginx so the browser never sees it.
- Kraken and Coinbase market data (public); Coinbase live broker. Live on an
  unsupported exchange now errors instead of silently falling back to paper.
- Strategy presets backed by the StrategyConfig table (CRUD API + UI).
- Idempotent additive-column migration so existing SQLite databases upgrade in
  place (fixes the new strategy_configs.name column).

backend/app/config.py

@@ -39,6 +39,26 @@ class Settings(BaseSettings):
     exchange_api_secret: str = ""
     exchange_sandbox: bool = False
 
+    # --- Risk controls (0 disables a limit) ---
+    # Absolute loss in quote currency since the start of the UTC day.
+    max_daily_loss: float = 0.0
+    # Percentage fall from peak equity.
+    max_drawdown_pct: float = 0.0
+    # Cap on a single position as a fraction of equity (1.0 = all-in).
+    max_position_pct: float = 1.0
+    # Maximum number of new entries per UTC day.
+    max_trades_per_day: int = 0
+
+    # --- Notifications ---
+    telegram_bot_token: str = ""
+    telegram_chat_id: str = ""
+    notify_webhook_url: str = ""
+
+    # Optional bearer token required on /api requests (defense-in-depth behind
+    # the Traefik Basic auth). Empty disables the check.
+    api_token: str = ""
+    api_token_header: str = "X-API-Token"
+
     cors_origins: str = "*"
 
     @field_validator("mode")