feat: multi-usuário com autenticação JWT

- Tabela `profiles` + coluna `profile_id` em todas as entidades
  (categories, transactions, recurring_expenses, accounts, player_profile,
   xp_events, player_quests, player_achievements, player_cosmetics)
- Dados existentes migrados para profile_id = 1 (Manoel)
- CLI `./api create-user --name <n> --password <p>` cria perfil com
  seed de categorias e player_profile; faz upsert de senha se já existir
- Auth substituída: cookie+APP_PASSWORD → JWT Bearer 24h (HS256)
- Middleware RequireAuth injeta profile_id no context de todas as rotas
- Todos os repositórios filtram por profile_id do context
- Endpoints: POST /api/auth/login, GET /api/auth/me,
  POST /api/auth/change-password, POST /api/logout
- Frontend: auth store usa localStorage (fc_token/fc_profile),
  api.ts envia Authorization header, LoginView usa campo name
- SettingsView reescrita com troca de senha e logout
- docker-compose.yml: remove APP_USERNAME/APP_PASSWORD, adiciona JWT_SECRET

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

apps/api/internal/repository/recurring.go

@@ -7,6 +7,7 @@ import (
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
 
+	"financeiro-carvalho/internal/middleware"
 	"financeiro-carvalho/internal/model"
 )
 
@@ -31,9 +32,10 @@ func NewRecurringRepository(db *pgxpool.Pool) RecurringRepository {
 }
 
 func (r *recurringRepo) List(ctx context.Context) ([]model.RecurringExpense, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	rows, err := r.db.Query(ctx, `
 		SELECT id, name, expected_amount, day_of_month, category_id, type, active, created_at, updated_at
-		FROM recurring_expenses ORDER BY name ASC`)
+		FROM recurring_expenses WHERE profile_id = $1 ORDER BY name ASC`, pid)
 	if err != nil {
 		return nil, err
 	}
@@ -50,10 +52,11 @@ func (r *recurringRepo) List(ctx context.Context) ([]model.RecurringExpense, err
 }
 
 func (r *recurringRepo) GetByID(ctx context.Context, id int) (*model.RecurringExpense, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	var re model.RecurringExpense
 	err := r.db.QueryRow(ctx, `
 		SELECT id, name, expected_amount, day_of_month, category_id, type, active, created_at, updated_at
-		FROM recurring_expenses WHERE id = $1`, id).
+		FROM recurring_expenses WHERE id = $1 AND profile_id = $2`, id, pid).
 		Scan(&re.ID, &re.Name, &re.ExpectedAmount, &re.DayOfMonth, &re.CategoryID, &re.Type, &re.Active, &re.CreatedAt, &re.UpdatedAt)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, ErrNotFound
@@ -62,21 +65,23 @@ func (r *recurringRepo) GetByID(ctx context.Context, id int) (*model.RecurringEx
 }
 
 func (r *recurringRepo) Create(ctx context.Context, in model.RecurringInput) (*model.RecurringExpense, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	t := in.Type
 	if t == "" {
 		t = "expense"
 	}
 	var re model.RecurringExpense
 	err := r.db.QueryRow(ctx, `
-		INSERT INTO recurring_expenses (name, expected_amount, day_of_month, category_id, type)
-		VALUES ($1, $2, $3, $4, $5)
+		INSERT INTO recurring_expenses (name, expected_amount, day_of_month, category_id, type, profile_id)
+		VALUES ($1, $2, $3, $4, $5, $6)
 		RETURNING id, name, expected_amount, day_of_month, category_id, type, active, created_at, updated_at`,
-		in.Name, in.ExpectedAmount, in.DayOfMonth, in.CategoryID, t).
+		in.Name, in.ExpectedAmount, in.DayOfMonth, in.CategoryID, t, pid).
 		Scan(&re.ID, &re.Name, &re.ExpectedAmount, &re.DayOfMonth, &re.CategoryID, &re.Type, &re.Active, &re.CreatedAt, &re.UpdatedAt)
 	return &re, err
 }
 
 func (r *recurringRepo) Update(ctx context.Context, id int, in model.RecurringInput) (*model.RecurringExpense, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	t := in.Type
 	if t == "" {
 		t = "expense"
@@ -85,9 +90,9 @@ func (r *recurringRepo) Update(ctx context.Context, id int, in model.RecurringIn
 	err := r.db.QueryRow(ctx, `
 		UPDATE recurring_expenses
 		SET name = $1, expected_amount = $2, day_of_month = $3, category_id = $4, type = $5, updated_at = NOW()
-		WHERE id = $6
+		WHERE id = $6 AND profile_id = $7
 		RETURNING id, name, expected_amount, day_of_month, category_id, type, active, created_at, updated_at`,
-		in.Name, in.ExpectedAmount, in.DayOfMonth, in.CategoryID, t, id).
+		in.Name, in.ExpectedAmount, in.DayOfMonth, in.CategoryID, t, id, pid).
 		Scan(&re.ID, &re.Name, &re.ExpectedAmount, &re.DayOfMonth, &re.CategoryID, &re.Type, &re.Active, &re.CreatedAt, &re.UpdatedAt)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, ErrNotFound
@@ -96,7 +101,8 @@ func (r *recurringRepo) Update(ctx context.Context, id int, in model.RecurringIn
 }
 
 func (r *recurringRepo) Delete(ctx context.Context, id int) error {
-	tag, err := r.db.Exec(ctx, `DELETE FROM recurring_expenses WHERE id = $1`, id)
+	pid := middleware.ProfileIDFromCtx(ctx)
+	tag, err := r.db.Exec(ctx, `DELETE FROM recurring_expenses WHERE id = $1 AND profile_id = $2`, id, pid)
 	if err != nil {
 		return err
 	}
@@ -106,6 +112,10 @@ func (r *recurringRepo) Delete(ctx context.Context, id int) error {
 	return nil
 }
 
+// IsIgnored, Ignore, Unignore, IsLate, MarkLate, UnmarkLate operate on recurring_ignores/recurring_late
+// which are scoped via FK to recurring_expenses (already profile-scoped). The caller (service) verifies
+// ownership via GetByID before reaching these methods.
+
 func (r *recurringRepo) IsIgnored(ctx context.Context, id int, month string) (bool, string, error) {
 	var reason string
 	err := r.db.QueryRow(ctx,