feat: session filter, breakeven SL, daily loss limit, startup alert, multi-pair web

Bot improvements:
- Session filter (SESSION_FROM_UTC/TO_UTC) — backtest confirms 08-13 UTC optimal for XAU
- Breakeven SL management (BREAKEVEN_AT_RR) — disabled by default, hurts XAU momentum
- Daily loss limit circuit breaker (DAILY_LOSS_LIMIT_PCT)
- Telegram startup alert with symbol, session, risk, and balance
- MT5 modify_position (TRADE_ACTION_SLTP) support in mt5-client

Web updates:
- Version badge auto-fetched from GitHub Releases API
- GitHub icon link in Nav and footer
- Multi-pair general (not XAUUSDm-specific)
- BTCUSDm backtest results added, session params in params table
- Trades page uses rolling 90-day window instead of hardcoded date

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -41,6 +41,20 @@ BACKTEST_CANDLES=50000
 # LIVE=true
 # LIVE_POLL_SECS=30
 
+# ── Optimisations ─────────────────────────────────────────────────────────────
+# Session filter: only take new entries when UTC hour in [FROM, TO).
+# Leave empty to disable. Recommended: 8-13 (London) based on live data.
+# SESSION_FROM_UTC=8
+# SESSION_TO_UTC=13
+
+# Breakeven: move SL to entry once price moves this multiple of SL-distance.
+# 0 = disabled, 1.0 = move at 1:1 RR
+# BREAKEVEN_AT_RR=1.0
+
+# Daily loss limit: halt new entries if today's closed PnL < -(balance × pct).
+# 0 = disabled, 0.03 = stop after -3% day
+# DAILY_LOSS_LIMIT_PCT=0.03
+
 # ── Telegram Notifications ───────────────────────────────────────────────────
 # Get token from @BotFather, chat_id from @userinfobot or Telegram API.
 # All three are optional — omit to disable notifications.