Risk controls, alerts, API token, more exchanges, presets

- RiskManager halts + flattens on max daily loss / drawdown, caps position
  size and trades per day; adds a manual kill switch (POST /api/bot/kill).
- Telegram and webhook notifications on trades, errors and halts.
- Optional API bearer token on /api, injected server-side by the frontend
  nginx so the browser never sees it.
- Kraken and Coinbase market data (public); Coinbase live broker. Live on an
  unsupported exchange now errors instead of silently falling back to paper.
- Strategy presets backed by the StrategyConfig table (CRUD API + UI).
- Idempotent additive-column migration so existing SQLite databases upgrade in
  place (fixes the new strategy_configs.name column).

docker-compose.local.yml

@@ -22,6 +22,15 @@ services:
       - EXCHANGE_API_KEY=${EXCHANGE_API_KEY:-}
       - EXCHANGE_API_SECRET=${EXCHANGE_API_SECRET:-}
       - EXCHANGE_SANDBOX=${EXCHANGE_SANDBOX:-false}
+      - MAX_DAILY_LOSS=${MAX_DAILY_LOSS:-0}
+      - MAX_DRAWDOWN_PCT=${MAX_DRAWDOWN_PCT:-0}
+      - MAX_POSITION_PCT=${MAX_POSITION_PCT:-1.0}
+      - MAX_TRADES_PER_DAY=${MAX_TRADES_PER_DAY:-0}
+      - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
+      - TELEGRAM_CHAT_ID=${TELEGRAM_CHAT_ID:-}
+      - NOTIFY_WEBHOOK_URL=${NOTIFY_WEBHOOK_URL:-}
+      - API_TOKEN=${API_TOKEN:-}
+      - API_TOKEN_HEADER=${API_TOKEN_HEADER:-X-API-Token}
     volumes:
       - ./data:/data
     ports:
@@ -29,9 +38,12 @@ services:
 
   frontend:
     build: ./frontend
-    container_name: crypto-trading-frontend-local
+    container_name: crypto-trader-frontend-local
     restart: unless-stopped
     depends_on:
       - backend
+    environment:
+      - API_TOKEN=${API_TOKEN:-}
+      - API_TOKEN_HEADER=${API_TOKEN_HEADER:-X-API-Token}
     ports:
       - "8080:80"