Risk controls, alerts, API token, more exchanges, presets

- RiskManager halts + flattens on max daily loss / drawdown, caps position
  size and trades per day; adds a manual kill switch (POST /api/bot/kill).
- Telegram and webhook notifications on trades, errors and halts.
- Optional API bearer token on /api, injected server-side by the frontend
  nginx so the browser never sees it.
- Kraken and Coinbase market data (public); Coinbase live broker. Live on an
  unsupported exchange now errors instead of silently falling back to paper.
- Strategy presets backed by the StrategyConfig table (CRUD API + UI).
- Idempotent additive-column migration so existing SQLite databases upgrade in
  place (fixes the new strategy_configs.name column).

backend/app/schemas.py

@@ -103,6 +103,35 @@ class StatusOut(BaseModel):
     open_positions: int
     last_tick: datetime | None
     error: str | None = None
+    halted: bool = False
+    halt_reason: str | None = None
+    trades_today: int = 0
+    day_pnl: float = 0.0
+    drawdown_pct: float = 0.0
+
+
+class KillRequest(BaseModel):
+    reason: str = "manual kill switch"
+
+
+class StrategyConfigIn(BaseModel):
+    name: str = Field(default="", max_length=80)
+    strategy_key: str
+    symbol: str
+    timeframe: str
+    params: dict[str, Any] = Field(default_factory=dict)
+
+
+class StrategyConfigOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    name: str
+    strategy_key: str
+    symbol: str
+    timeframe: str
+    params: dict[str, Any]
+    created_at: datetime
 
 
 class StartRequest(BaseModel):