Risk controls, alerts, API token, more exchanges, presets

- RiskManager halts + flattens on max daily loss / drawdown, caps position
  size and trades per day; adds a manual kill switch (POST /api/bot/kill).
- Telegram and webhook notifications on trades, errors and halts.
- Optional API bearer token on /api, injected server-side by the frontend
  nginx so the browser never sees it.
- Kraken and Coinbase market data (public); Coinbase live broker. Live on an
  unsupported exchange now errors instead of silently falling back to paper.
- Strategy presets backed by the StrategyConfig table (CRUD API + UI).
- Idempotent additive-column migration so existing SQLite databases upgrade in
  place (fixes the new strategy_configs.name column).

backend/app/db.py

@@ -1,15 +1,25 @@
 from __future__ import annotations
 
+import logging
 from collections.abc import Iterator
 
-from sqlalchemy import create_engine
+from sqlalchemy import Engine, create_engine, inspect, text
 from sqlalchemy.orm import Session, sessionmaker
 
 from app.config import REPO_ROOT, get_settings
 from app.models import Base
 
+logger = logging.getLogger(__name__)
+
 _settings = get_settings()
 
+# Additive migrations for existing databases. ``create_all`` only creates missing
+# tables; it never alters existing ones, so new nullable/defaulted columns are
+# added here as (table, column, DDL type) tuples.
+_ADDITIVE_COLUMNS: list[tuple[str, str, str]] = [
+    ("strategy_configs", "name", "VARCHAR(80) DEFAULT ''"),
+]
+
 
 def _normalize_url(url: str) -> tuple[str, dict]:
     connect_args: dict = {}
@@ -26,8 +36,23 @@ engine = create_engine(_url, connect_args=_connect_args, pool_pre_ping=True)
 SessionLocal = sessionmaker(bind=engine, autoflush=False, expire_on_commit=False)
 
 
+def _apply_additive_columns(target: Engine) -> None:
+    inspector = inspect(target)
+    existing_tables = set(inspector.get_table_names())
+    with target.begin() as connection:
+        for table, column, ddl in _ADDITIVE_COLUMNS:
+            if table not in existing_tables:
+                continue
+            columns = {col["name"] for col in inspector.get_columns(table)}
+            if column in columns:
+                continue
+            logger.info("migrating: adding %s.%s", table, column)
+            connection.execute(text(f"ALTER TABLE {table} ADD COLUMN {column} {ddl}"))
+
+
 def init_db() -> None:
     Base.metadata.create_all(bind=engine)
+    _apply_additive_columns(engine)
 
 
 def get_session() -> Iterator[Session]: