Risk controls, alerts, API token, more exchanges, presets

- RiskManager halts + flattens on max daily loss / drawdown, caps position
  size and trades per day; adds a manual kill switch (POST /api/bot/kill).
- Telegram and webhook notifications on trades, errors and halts.
- Optional API bearer token on /api, injected server-side by the frontend
  nginx so the browser never sees it.
- Kraken and Coinbase market data (public); Coinbase live broker. Live on an
  unsupported exchange now errors instead of silently falling back to paper.
- Strategy presets backed by the StrategyConfig table (CRUD API + UI).
- Idempotent additive-column migration so existing SQLite databases upgrade in
  place (fixes the new strategy_configs.name column).

docker-compose.yml

@@ -32,6 +32,15 @@ services:
       - EXCHANGE_API_KEY=${CRYPTO_EXCHANGE_API_KEY:-}
       - EXCHANGE_API_SECRET=${CRYPTO_EXCHANGE_API_SECRET:-}
       - EXCHANGE_SANDBOX=${CRYPTO_EXCHANGE_SANDBOX:-false}
+      - MAX_DAILY_LOSS=${CRYPTO_MAX_DAILY_LOSS:-0}
+      - MAX_DRAWDOWN_PCT=${CRYPTO_MAX_DRAWDOWN_PCT:-0}
+      - MAX_POSITION_PCT=${CRYPTO_MAX_POSITION_PCT:-1.0}
+      - MAX_TRADES_PER_DAY=${CRYPTO_MAX_TRADES_PER_DAY:-0}
+      - TELEGRAM_BOT_TOKEN=${CRYPTO_TELEGRAM_BOT_TOKEN:-}
+      - TELEGRAM_CHAT_ID=${CRYPTO_TELEGRAM_CHAT_ID:-}
+      - NOTIFY_WEBHOOK_URL=${CRYPTO_NOTIFY_WEBHOOK_URL:-}
+      - API_TOKEN=${CRYPTO_API_TOKEN:-}
+      - API_TOKEN_HEADER=${CRYPTO_API_TOKEN_HEADER:-X-API-Token}
     volumes:
       # Persist the SQLite database across releases. Prefer an absolute host
       # path (CRYPTO_DATA_DIR / PERSISTENT_MOUNT); the repo-relative default
@@ -63,6 +72,9 @@ services:
     depends_on:
       backend:
         condition: service_healthy
+    environment:
+      - API_TOKEN=${CRYPTO_API_TOKEN:-}
+      - API_TOKEN_HEADER=${CRYPTO_API_TOKEN_HEADER:-X-API-Token}
     healthcheck:
       test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:80/ || exit 1"]
       interval: 30s