Risk controls, alerts, API token, more exchanges, presets

- RiskManager halts + flattens on max daily loss / drawdown, caps position
  size and trades per day; adds a manual kill switch (POST /api/bot/kill).
- Telegram and webhook notifications on trades, errors and halts.
- Optional API bearer token on /api, injected server-side by the frontend
  nginx so the browser never sees it.
- Kraken and Coinbase market data (public); Coinbase live broker. Live on an
  unsupported exchange now errors instead of silently falling back to paper.
- Strategy presets backed by the StrategyConfig table (CRUD API + UI).
- Idempotent additive-column migration so existing SQLite databases upgrade in
  place (fixes the new strategy_configs.name column).

frontend/src/api.js

@@ -11,12 +11,18 @@ export const getEquity = () => http.get('/equity').then((r) => r.data)
 
 export const startBot = (payload) => http.post('/bot/start', payload).then((r) => r.data)
 export const stopBot = () => http.post('/bot/stop').then((r) => r.data)
+export const killBot = (reason = 'manual kill switch') =>
+  http.post('/bot/kill', { reason }).then((r) => r.data)
 export const closePosition = (id, reason = 'manual') =>
   http.post(`/positions/${id}/close`, { reason }).then((r) => r.data)
 export const placeOrder = (payload) => http.post('/orders', payload).then((r) => r.data)
 export const runBacktest = (payload) =>
   http.post('/backtest', payload, { timeout: 60000 }).then((r) => r.data)
 
+export const getPresets = () => http.get('/presets').then((r) => r.data)
+export const createPreset = (payload) => http.post('/presets', payload).then((r) => r.data)
+export const deletePreset = (id) => http.delete(`/presets/${id}`).then((r) => r.data)
+
 export function openSocket({ onMessage, onOpen, onClose }) {
   const proto = window.location.protocol === 'https:' ? 'wss' : 'ws'
   let socket