Risk controls, alerts, API token, more exchanges, presets

- RiskManager halts + flattens on max daily loss / drawdown, caps position
  size and trades per day; adds a manual kill switch (POST /api/bot/kill).
- Telegram and webhook notifications on trades, errors and halts.
- Optional API bearer token on /api, injected server-side by the frontend
  nginx so the browser never sees it.
- Kraken and Coinbase market data (public); Coinbase live broker. Live on an
  unsupported exchange now errors instead of silently falling back to paper.
- Strategy presets backed by the StrategyConfig table (CRUD API + UI).
- Idempotent additive-column migration so existing SQLite databases upgrade in
  place (fixes the new strategy_configs.name column).

backend/tests/test_migrations.py

@@ -0,0 +1,42 @@
+from __future__ import annotations
+
+from sqlalchemy import create_engine, inspect, text
+
+from app.db import _apply_additive_columns
+
+
+def test_additive_columns_added_to_legacy_table() -> None:
+    engine = create_engine("sqlite://")
+    with engine.begin() as connection:
+        connection.execute(
+            text(
+                "CREATE TABLE strategy_configs ("
+                "id INTEGER PRIMARY KEY, strategy_key VARCHAR(64), "
+                "symbol VARCHAR(32), timeframe VARCHAR(16), params JSON, "
+                "created_at DATETIME)"
+            )
+        )
+
+    _apply_additive_columns(engine)
+
+    columns = {col["name"] for col in inspect(engine).get_columns("strategy_configs")}
+    assert "name" in columns
+
+
+def test_additive_columns_is_idempotent() -> None:
+    engine = create_engine("sqlite://")
+    with engine.begin() as connection:
+        connection.execute(
+            text(
+                "CREATE TABLE strategy_configs ("
+                "id INTEGER PRIMARY KEY, name VARCHAR(80), strategy_key VARCHAR(64), "
+                "symbol VARCHAR(32), timeframe VARCHAR(16), params JSON, "
+                "created_at DATETIME)"
+            )
+        )
+
+    _apply_additive_columns(engine)
+    _apply_additive_columns(engine)
+
+    columns = [col["name"] for col in inspect(engine).get_columns("strategy_configs")]
+    assert columns.count("name") == 1