feat: multi-usuário com autenticação JWT

- Tabela `profiles` + coluna `profile_id` em todas as entidades
  (categories, transactions, recurring_expenses, accounts, player_profile,
   xp_events, player_quests, player_achievements, player_cosmetics)
- Dados existentes migrados para profile_id = 1 (Manoel)
- CLI `./api create-user --name <n> --password <p>` cria perfil com
  seed de categorias e player_profile; faz upsert de senha se já existir
- Auth substituída: cookie+APP_PASSWORD → JWT Bearer 24h (HS256)
- Middleware RequireAuth injeta profile_id no context de todas as rotas
- Todos os repositórios filtram por profile_id do context
- Endpoints: POST /api/auth/login, GET /api/auth/me,
  POST /api/auth/change-password, POST /api/logout
- Frontend: auth store usa localStorage (fc_token/fc_profile),
  api.ts envia Authorization header, LoginView usa campo name
- SettingsView reescrita com troca de senha e logout
- docker-compose.yml: remove APP_USERNAME/APP_PASSWORD, adiciona JWT_SECRET

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

apps/api/internal/migration/migration.go

@@ -47,6 +47,9 @@ var m012 string
 //go:embed sql/013_transaction_original_date.sql
 var m013 string
 
+//go:embed sql/014_profiles.sql
+var m014 string
+
 func Run(ctx context.Context, pool *pgxpool.Pool) error {
 	// Bootstrap: ensure schema_migrations table exists before checking versions.
 	if _, err := pool.Exec(ctx, `
@@ -58,7 +61,7 @@ func Run(ctx context.Context, pool *pgxpool.Pool) error {
 		return fmt.Errorf("bootstrap schema_migrations: %w", err)
 	}
 
-	migrations := []string{m001, m002, m003, m004, m005, m006, m007, m008, m009, m010, m011, m012, m013}
+	migrations := []string{m001, m002, m003, m004, m005, m006, m007, m008, m009, m010, m011, m012, m013, m014}
 	for i, sql := range migrations {
 		version := i + 1
 		var applied bool