feat(#18): import de extratos OFX e CSV — parser, dedup, preview e confirmação

Parser OFX tolerante ao formato SGML de bancos brasileiros (sem closing tags, BOM,
timezone suffix). Parser CSV com separador de campo/decimal configurável. Dedup por
FITID (OFX) ou date+amount+desc normalizado. Fluxo: POST /preview → revisão na UI
→ POST /confirm salva e loga. Migration 002 adiciona external_id com unique index.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

apps/api/internal/handler/import.go

@@ -0,0 +1,82 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"financeiro-carvalho/internal/model"
+	"financeiro-carvalho/internal/service"
+)
+
+const maxUploadSize = 10 << 20 // 10 MB
+
+type ImportHandler struct {
+	svc *service.ImportService
+}
+
+func NewImportHandler(svc *service.ImportService) *ImportHandler {
+	return &ImportHandler{svc: svc}
+}
+
+// Preview parses the uploaded file and returns rows with duplicate flags.
+// POST /api/imports/preview   multipart: file + optional csv_mapping JSON field
+func (h *ImportHandler) Preview(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, maxUploadSize)
+	if err := r.ParseMultipartForm(maxUploadSize); err != nil {
+		respondError(w, http.StatusBadRequest, "file too large or invalid form")
+		return
+	}
+
+	file, header, err := r.FormFile("file")
+	if err != nil {
+		respondError(w, http.StatusBadRequest, "field 'file' is required")
+		return
+	}
+	defer file.Close()
+
+	var csvMapping *model.CSVMapping
+	if raw := r.FormValue("csv_mapping"); raw != "" {
+		var m model.CSVMapping
+		if err := json.Unmarshal([]byte(raw), &m); err != nil {
+			respondError(w, http.StatusBadRequest, "invalid csv_mapping JSON")
+			return
+		}
+		csvMapping = &m
+	}
+
+	rows, parseErrs, err := h.svc.Preview(r.Context(), header.Filename, file, csvMapping)
+	if err != nil {
+		respondError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	respondJSON(w, http.StatusOK, map[string]any{
+		"rows":        rows,
+		"parse_errors": parseErrs,
+	})
+}
+
+// Confirm saves the rows provided in the request body (after user review).
+// POST /api/imports/confirm
+func (h *ImportHandler) Confirm(w http.ResponseWriter, r *http.Request) {
+	var body struct {
+		Filename      string           `json:"filename"`
+		Rows          []model.ImportRow `json:"rows"`
+		ParseErrCount int              `json:"parse_error_count"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		respondError(w, http.StatusBadRequest, "invalid JSON")
+		return
+	}
+	if body.Filename == "" {
+		respondError(w, http.StatusBadRequest, "filename is required")
+		return
+	}
+
+	result, err := h.svc.Confirm(r.Context(), body.Filename, body.Rows, body.ParseErrCount)
+	if err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to save transactions")
+		return
+	}
+	respondJSON(w, http.StatusOK, result)
+}