Risk controls, alerts, API token, more exchanges, presets

- RiskManager halts + flattens on max daily loss / drawdown, caps position
  size and trades per day; adds a manual kill switch (POST /api/bot/kill).
- Telegram and webhook notifications on trades, errors and halts.
- Optional API bearer token on /api, injected server-side by the frontend
  nginx so the browser never sees it.
- Kraken and Coinbase market data (public); Coinbase live broker. Live on an
  unsupported exchange now errors instead of silently falling back to paper.
- Strategy presets backed by the StrategyConfig table (CRUD API + UI).
- Idempotent additive-column migration so existing SQLite databases upgrade in
  place (fixes the new strategy_configs.name column).

frontend/src/App.vue

@@ -28,6 +28,7 @@ const status = ref({
 })
 
 const strategies = ref([])
+const presets = ref([])
 const positions = ref([])
 const orders = ref([])
 const events = ref([])
@@ -55,6 +56,20 @@ async function loadStrategies() {
   strategies.value = await api.getStrategies()
 }
 
+async function loadPresets() {
+  presets.value = await api.getPresets()
+}
+
+async function handleSavePreset(payload) {
+  await api.createPreset(payload)
+  await loadPresets()
+}
+
+async function handleDeletePreset(id) {
+  await api.deletePreset(id)
+  await loadPresets()
+}
+
 async function handleStart(payload) {
   busy.value = true
   try {
@@ -77,6 +92,18 @@ async function handleStop() {
   }
 }
 
+async function handleKill() {
+  busy.value = true
+  try {
+    status.value = await api.killBot('manual kill switch')
+    await refreshAll()
+  } catch (error) {
+    status.value = { ...status.value, error: error.response?.data?.detail || error.message }
+  } finally {
+    busy.value = false
+  }
+}
+
 async function handleClose(id) {
   try {
     status.value = await api.closePosition(id)
@@ -96,7 +123,12 @@ function handleMessage(message) {
 }
 
 onMounted(async () => {
-  await Promise.all([loadStrategies(), api.getStatus().then((s) => (status.value = s)), refreshAll()])
+  await Promise.all([
+    loadStrategies(),
+    loadPresets(),
+    api.getStatus().then((s) => (status.value = s)),
+    refreshAll(),
+  ])
   socket = api.openSocket({
     onMessage: handleMessage,
     onOpen: () => (connected.value = true),
@@ -137,6 +169,14 @@ onUnmounted(() => {
       </div>
     </header>
 
+    <div
+      v-if="status.halted"
+      class="rounded-lg border border-rose-500 bg-rose-500/20 p-3 text-sm font-semibold text-rose-100"
+    >
+      HALTED — {{ status.halt_reason }}. Trading is stopped and any open position was
+      flattened. Restart the bot to resume (limits reset).
+    </div>
+
     <div v-if="status.error" class="rounded-lg border border-rose-500/40 bg-rose-500/10 p-3 text-sm text-rose-200">
       {{ status.error }}
     </div>
@@ -147,8 +187,12 @@ onUnmounted(() => {
       :strategies="strategies"
       :status="status"
       :busy="busy"
+      :presets="presets"
       @start="handleStart"
       @stop="handleStop"
+      @kill="handleKill"
+      @save-preset="handleSavePreset"
+      @delete-preset="handleDeletePreset"
     />
 
     <BacktestPanel :strategies="strategies" :status="status" />