feat: multi-usuário com autenticação JWT

- Tabela `profiles` + coluna `profile_id` em todas as entidades
  (categories, transactions, recurring_expenses, accounts, player_profile,
   xp_events, player_quests, player_achievements, player_cosmetics)
- Dados existentes migrados para profile_id = 1 (Manoel)
- CLI `./api create-user --name <n> --password <p>` cria perfil com
  seed de categorias e player_profile; faz upsert de senha se já existir
- Auth substituída: cookie+APP_PASSWORD → JWT Bearer 24h (HS256)
- Middleware RequireAuth injeta profile_id no context de todas as rotas
- Todos os repositórios filtram por profile_id do context
- Endpoints: POST /api/auth/login, GET /api/auth/me,
  POST /api/auth/change-password, POST /api/logout
- Frontend: auth store usa localStorage (fc_token/fc_profile),
  api.ts envia Authorization header, LoginView usa campo name
- SettingsView reescrita com troca de senha e logout
- docker-compose.yml: remove APP_USERNAME/APP_PASSWORD, adiciona JWT_SECRET

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

apps/api/internal/repository/account.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/jackc/pgx/v5/pgxpool"
 
+	"financeiro-carvalho/internal/middleware"
 	"financeiro-carvalho/internal/model"
 )
 
@@ -28,6 +29,7 @@ func NewAccountRepository(pool *pgxpool.Pool) *AccountRepository {
 }
 
 func (r *AccountRepository) List(ctx context.Context) ([]model.Account, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	rows, err := r.pool.Query(ctx, `
 		SELECT
 			a.id, a.name, a.type, a.initial_balance,
@@ -40,9 +42,10 @@ func (r *AccountRepository) List(ctx context.Context) ([]model.Account, error) {
 			AS balance
 		FROM accounts a
 		LEFT JOIN transactions t ON t.account_id = a.id
+		WHERE a.profile_id = $1
 		GROUP BY a.id
 		ORDER BY a.created_at
-	`)
+	`, pid)
 	if err != nil {
 		return nil, err
 	}
@@ -60,6 +63,7 @@ func (r *AccountRepository) List(ctx context.Context) ([]model.Account, error) {
 }
 
 func (r *AccountRepository) GetByID(ctx context.Context, id int) (*model.Account, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	var a model.Account
 	err := r.pool.QueryRow(ctx, `
 		SELECT
@@ -73,9 +77,9 @@ func (r *AccountRepository) GetByID(ctx context.Context, id int) (*model.Account
 			AS balance
 		FROM accounts a
 		LEFT JOIN transactions t ON t.account_id = a.id
-		WHERE a.id = $1
+		WHERE a.id = $1 AND a.profile_id = $2
 		GROUP BY a.id
-	`, id).Scan(&a.ID, &a.Name, &a.Type, &a.InitialBalance, &a.YieldType, &a.LastYieldDate, &a.ClosingDay, &a.DueDay, &a.CreatedAt, &a.UpdatedAt, &a.Balance)
+	`, id, pid).Scan(&a.ID, &a.Name, &a.Type, &a.InitialBalance, &a.YieldType, &a.LastYieldDate, &a.ClosingDay, &a.DueDay, &a.CreatedAt, &a.UpdatedAt, &a.Balance)
 	if err != nil {
 		return nil, err
 	}
@@ -83,16 +87,17 @@ func (r *AccountRepository) GetByID(ctx context.Context, id int) (*model.Account
 }
 
 func (r *AccountRepository) Create(ctx context.Context, in model.AccountInput) (*model.Account, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	yt := in.YieldType
 	if yt == "" {
 		yt = "none"
 	}
 	var a model.Account
 	err := r.pool.QueryRow(ctx, `
-		INSERT INTO accounts (name, type, initial_balance, yield_type, closing_day, due_day)
-		VALUES ($1, $2, $3, $4, $5, $6)
+		INSERT INTO accounts (name, type, initial_balance, yield_type, closing_day, due_day, profile_id)
+		VALUES ($1, $2, $3, $4, $5, $6, $7)
 		RETURNING id, name, type, initial_balance, yield_type, last_yield_date::text, closing_day, due_day, created_at::text, updated_at::text
-	`, in.Name, in.Type, in.InitialBalance, yt, in.ClosingDay, in.DueDay).
+	`, in.Name, in.Type, in.InitialBalance, yt, in.ClosingDay, in.DueDay, pid).
 		Scan(&a.ID, &a.Name, &a.Type, &a.InitialBalance, &a.YieldType, &a.LastYieldDate, &a.ClosingDay, &a.DueDay, &a.CreatedAt, &a.UpdatedAt)
 	if err != nil {
 		return nil, err
@@ -102,15 +107,16 @@ func (r *AccountRepository) Create(ctx context.Context, in model.AccountInput) (
 }
 
 func (r *AccountRepository) Update(ctx context.Context, id int, in model.AccountInput) (*model.Account, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	yt := in.YieldType
 	if yt == "" {
 		yt = "none"
 	}
 	row := r.pool.QueryRow(ctx, `
 		UPDATE accounts SET name=$1, type=$2, initial_balance=$3, yield_type=$4, closing_day=$5, due_day=$6, updated_at=NOW()
-		WHERE id=$7
+		WHERE id=$7 AND profile_id=$8
 		RETURNING id, name, type, initial_balance, yield_type, last_yield_date::text, closing_day, due_day, created_at::text, updated_at::text
-	`, in.Name, in.Type, in.InitialBalance, yt, in.ClosingDay, in.DueDay, id)
+	`, in.Name, in.Type, in.InitialBalance, yt, in.ClosingDay, in.DueDay, id, pid)
 	var a model.Account
 	if err := row.Scan(&a.ID, &a.Name, &a.Type, &a.InitialBalance, &a.YieldType, &a.LastYieldDate, &a.ClosingDay, &a.DueDay, &a.CreatedAt, &a.UpdatedAt); err != nil {
 		return nil, err
@@ -123,11 +129,13 @@ func (r *AccountRepository) Update(ctx context.Context, id int, in model.Account
 }
 
 func (r *AccountRepository) Delete(ctx context.Context, id int) error {
-	_, err := r.pool.Exec(ctx, `DELETE FROM accounts WHERE id = $1`, id)
+	pid := middleware.ProfileIDFromCtx(ctx)
+	_, err := r.pool.Exec(ctx, `DELETE FROM accounts WHERE id = $1 AND profile_id = $2`, id, pid)
 	return err
 }
 
 func (r *AccountRepository) TotalPatrimony(ctx context.Context) (float64, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	var total float64
 	err := r.pool.QueryRow(ctx, `
 		SELECT COALESCE(SUM(
@@ -138,11 +146,14 @@ func (r *AccountRepository) TotalPatrimony(ctx context.Context) (float64, error)
 				  ), 0)
 		), 0)
 		FROM accounts a
-	`).Scan(&total)
+		WHERE a.profile_id = $1
+	`, pid).Scan(&total)
 	return total, err
 }
 
 func (r *AccountRepository) UpdateLastYieldDate(ctx context.Context, id int, date string) error {
-	_, err := r.pool.Exec(ctx, `UPDATE accounts SET last_yield_date = $1 WHERE id = $2`, date, id)
+	pid := middleware.ProfileIDFromCtx(ctx)
+	_, err := r.pool.Exec(ctx,
+		`UPDATE accounts SET last_yield_date = $1 WHERE id = $2 AND profile_id = $3`, date, id, pid)
 	return err
 }