feat: multi-usuário com autenticação JWT

- Tabela `profiles` + coluna `profile_id` em todas as entidades
  (categories, transactions, recurring_expenses, accounts, player_profile,
   xp_events, player_quests, player_achievements, player_cosmetics)
- Dados existentes migrados para profile_id = 1 (Manoel)
- CLI `./api create-user --name <n> --password <p>` cria perfil com
  seed de categorias e player_profile; faz upsert de senha se já existir
- Auth substituída: cookie+APP_PASSWORD → JWT Bearer 24h (HS256)
- Middleware RequireAuth injeta profile_id no context de todas as rotas
- Todos os repositórios filtram por profile_id do context
- Endpoints: POST /api/auth/login, GET /api/auth/me,
  POST /api/auth/change-password, POST /api/logout
- Frontend: auth store usa localStorage (fc_token/fc_profile),
  api.ts envia Authorization header, LoginView usa campo name
- SettingsView reescrita com troca de senha e logout
- docker-compose.yml: remove APP_USERNAME/APP_PASSWORD, adiciona JWT_SECRET

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

apps/api/internal/repository/credit_bill.go

@@ -7,6 +7,7 @@ import (
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
 
+	"financeiro-carvalho/internal/middleware"
 	"financeiro-carvalho/internal/model"
 )
 
@@ -24,6 +25,7 @@ func NewCreditBillRepository(db *pgxpool.Pool) CreditBillRepository {
 }
 
 func (r *creditBillRepo) ListByAccount(ctx context.Context, accountID int) ([]model.CreditBill, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	rows, err := r.db.Query(ctx, `
 		SELECT
 			cb.id, cb.account_id, a.name,
@@ -31,14 +33,14 @@ func (r *creditBillRepo) ListByAccount(ctx context.Context, accountID int) ([]mo
 			COALESCE(SUM(t.amount) FILTER (WHERE t.type = 'expense'), 0) AS total,
 			cb.paid, cb.paid_at::text, cb.payment_account_id
 		FROM credit_bills cb
-		JOIN accounts a ON a.id = cb.account_id
+		JOIN accounts a ON a.id = cb.account_id AND a.profile_id = $2
 		LEFT JOIN transactions t ON t.account_id = cb.account_id
 			AND t.date >= cb.period_start AND t.date <= cb.period_end
 			AND t.type = 'expense'
 		WHERE cb.account_id = $1
 		GROUP BY cb.id, a.name
 		ORDER BY cb.period_start DESC
-	`, accountID)
+	`, accountID, pid)
 	if err != nil {
 		return nil, err
 	}
@@ -55,6 +57,7 @@ func (r *creditBillRepo) ListByAccount(ctx context.Context, accountID int) ([]mo
 }
 
 func (r *creditBillRepo) GetCurrent(ctx context.Context, accountID int) (*model.CreditBill, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	var b model.CreditBill
 	err := r.db.QueryRow(ctx, `
 		SELECT
@@ -63,7 +66,7 @@ func (r *creditBillRepo) GetCurrent(ctx context.Context, accountID int) (*model.
 			COALESCE(SUM(t.amount) FILTER (WHERE t.type = 'expense'), 0) AS total,
 			cb.paid, cb.paid_at::text, cb.payment_account_id
 		FROM credit_bills cb
-		JOIN accounts a ON a.id = cb.account_id
+		JOIN accounts a ON a.id = cb.account_id AND a.profile_id = $2
 		LEFT JOIN transactions t ON t.account_id = cb.account_id
 			AND t.date >= cb.period_start AND t.date <= cb.period_end
 			AND t.type = 'expense'
@@ -71,7 +74,7 @@ func (r *creditBillRepo) GetCurrent(ctx context.Context, accountID int) (*model.
 		GROUP BY cb.id, a.name
 		ORDER BY cb.period_start DESC
 		LIMIT 1
-	`, accountID).Scan(&b.ID, &b.AccountID, &b.AccountName, &b.PeriodStart, &b.PeriodEnd, &b.DueDate, &b.Total, &b.Paid, &b.PaidAt, &b.PaymentAccountID)
+	`, accountID, pid).Scan(&b.ID, &b.AccountID, &b.AccountName, &b.PeriodStart, &b.PeriodEnd, &b.DueDate, &b.Total, &b.Paid, &b.PaidAt, &b.PaymentAccountID)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, nil
 	}
@@ -94,10 +97,12 @@ func (r *creditBillRepo) Upsert(ctx context.Context, in model.CreditBillInput) (
 }
 
 func (r *creditBillRepo) MarkPaid(ctx context.Context, id int, paymentAccountID *int) error {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	_, err := r.db.Exec(ctx, `
-		UPDATE credit_bills
+		UPDATE credit_bills cb
 		SET paid = TRUE, paid_at = NOW(), payment_account_id = $2
-		WHERE id = $1
-	`, id, paymentAccountID)
+		FROM accounts a
+		WHERE cb.id = $1 AND cb.account_id = a.id AND a.profile_id = $3
+	`, id, paymentAccountID, pid)
 	return err
 }