Risk controls, alerts, API token, more exchanges, presets

- RiskManager halts + flattens on max daily loss / drawdown, caps position
  size and trades per day; adds a manual kill switch (POST /api/bot/kill).
- Telegram and webhook notifications on trades, errors and halts.
- Optional API bearer token on /api, injected server-side by the frontend
  nginx so the browser never sees it.
- Kraken and Coinbase market data (public); Coinbase live broker. Live on an
  unsupported exchange now errors instead of silently falling back to paper.
- Strategy presets backed by the StrategyConfig table (CRUD API + UI).
- Idempotent additive-column migration so existing SQLite databases upgrade in
  place (fixes the new strategy_configs.name column).

frontend/src/components/StrategyPanel.vue

@@ -5,8 +5,15 @@ const props = defineProps({
   strategies: { type: Array, required: true },
   status: { type: Object, required: true },
   busy: { type: Boolean, default: false },
+  presets: { type: Array, default: () => [] },
 })
-const emit = defineEmits(['start', 'stop'])
+const emit = defineEmits(['start', 'stop', 'kill', 'save-preset', 'delete-preset'])
+
+function confirmKill() {
+  if (window.confirm('Kill switch: flatten the position and halt trading?')) {
+    emit('kill')
+  }
+}
 </script>
 
 <template>
@@ -28,11 +35,23 @@ const emit = defineEmits(['start', 'stop'])
       submit-label="Start bot"
       :symbol="status.symbol"
       :timeframe="status.timeframe"
+      :presets="presets"
       @submit="emit('start', $event)"
+      @save-preset="emit('save-preset', $event)"
+      @delete-preset="emit('delete-preset', $event)"
     />
 
-    <button class="btn-danger" :disabled="busy || !status.running" @click="emit('stop')">
-      Stop bot
-    </button>
+    <div class="flex flex-wrap gap-2">
+      <button class="btn-danger" :disabled="busy || !status.running" @click="emit('stop')">
+        Stop bot
+      </button>
+      <button
+        class="btn bg-rose-700 font-bold uppercase text-white hover:bg-rose-600"
+        :disabled="busy || (!status.running && status.open_positions === 0)"
+        @click="confirmKill"
+      >
+        Kill switch
+      </button>
+    </div>
   </div>
 </template>