Risk controls, alerts, API token, more exchanges, presets

- RiskManager halts + flattens on max daily loss / drawdown, caps position
  size and trades per day; adds a manual kill switch (POST /api/bot/kill).
- Telegram and webhook notifications on trades, errors and halts.
- Optional API bearer token on /api, injected server-side by the frontend
  nginx so the browser never sees it.
- Kraken and Coinbase market data (public); Coinbase live broker. Live on an
  unsupported exchange now errors instead of silently falling back to paper.
- Strategy presets backed by the StrategyConfig table (CRUD API + UI).
- Idempotent additive-column migration so existing SQLite databases upgrade in
  place (fixes the new strategy_configs.name column).

backend/app/store.py

@@ -162,12 +162,37 @@ class Store:
         return list(reversed(rows))
 
     def save_strategy_config(
-        self, strategy_key: str, symbol: str, timeframe: str, params: dict
+        self,
+        *,
+        name: str,
+        strategy_key: str,
+        symbol: str,
+        timeframe: str,
+        params: dict,
     ) -> StrategyConfig:
         with self._session_factory() as session:
             config = StrategyConfig(
-                strategy_key=strategy_key, symbol=symbol, timeframe=timeframe, params=params
+                name=name,
+                strategy_key=strategy_key,
+                symbol=symbol,
+                timeframe=timeframe,
+                params=params,
             )
             session.add(config)
             session.commit()
             return config
+
+    def list_strategy_configs(self) -> list[StrategyConfig]:
+        with self._session_factory() as session:
+            return list(
+                session.scalars(select(StrategyConfig).order_by(StrategyConfig.id.desc())).all()
+            )
+
+    def delete_strategy_config(self, config_id: int) -> bool:
+        with self._session_factory() as session:
+            config = session.get(StrategyConfig, config_id)
+            if config is None:
+                return False
+            session.delete(config)
+            session.commit()
+            return True