feat: session filter, breakeven SL, daily loss limit, startup alert, multi-pair web

Bot improvements:
- Session filter (SESSION_FROM_UTC/TO_UTC) — backtest confirms 08-13 UTC optimal for XAU
- Breakeven SL management (BREAKEVEN_AT_RR) — disabled by default, hurts XAU momentum
- Daily loss limit circuit breaker (DAILY_LOSS_LIMIT_PCT)
- Telegram startup alert with symbol, session, risk, and balance
- MT5 modify_position (TRADE_ACTION_SLTP) support in mt5-client

Web updates:
- Version badge auto-fetched from GitHub Releases API
- GitHub icon link in Nav and footer
- Multi-pair general (not XAUUSDm-specific)
- BTCUSDm backtest results added, session params in params table
- Trades page uses rolling 90-day window instead of hardcoded date

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/lib/mt5.ts

@@ -107,8 +107,11 @@ export async function getDeals(dateFrom: string, dateTo: string, symbol?: string
 
 // Fetch all deals from startDate to now by querying one day at a time,
 // working around the MT5 bridge per-request deal limit.
-export async function getAllDeals(startDate: string): Promise<Deal[]> {
-  const start = new Date(startDate);
+// startDate defaults to 90 days ago if omitted.
+export async function getAllDeals(startDate?: string): Promise<Deal[]> {
+  const start = startDate
+    ? new Date(startDate)
+    : (() => { const d = new Date(); d.setUTCDate(d.getUTCDate() - 90); return d; })();
   const now   = new Date();
   const days: Array<[string, string]> = [];