feat: multi-usuário com autenticação JWT

- Tabela `profiles` + coluna `profile_id` em todas as entidades
  (categories, transactions, recurring_expenses, accounts, player_profile,
   xp_events, player_quests, player_achievements, player_cosmetics)
- Dados existentes migrados para profile_id = 1 (Manoel)
- CLI `./api create-user --name <n> --password <p>` cria perfil com
  seed de categorias e player_profile; faz upsert de senha se já existir
- Auth substituída: cookie+APP_PASSWORD → JWT Bearer 24h (HS256)
- Middleware RequireAuth injeta profile_id no context de todas as rotas
- Todos os repositórios filtram por profile_id do context
- Endpoints: POST /api/auth/login, GET /api/auth/me,
  POST /api/auth/change-password, POST /api/logout
- Frontend: auth store usa localStorage (fc_token/fc_profile),
  api.ts envia Authorization header, LoginView usa campo name
- SettingsView reescrita com troca de senha e logout
- docker-compose.yml: remove APP_USERNAME/APP_PASSWORD, adiciona JWT_SECRET

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

apps/api/internal/repository/transaction.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/jackc/pgx/v5/pgxpool"
 
+	"financeiro-carvalho/internal/middleware"
 	"financeiro-carvalho/internal/model"
 )
 
@@ -22,17 +23,17 @@ func NewTransactionRepository(db *pgxpool.Pool) TransactionRepository {
 	return &transactionRepo{db: db}
 }
 
-// normalizeDesc lowercases and collapses whitespace for fuzzy dedup.
 func normalizeDesc(s string) string {
 	return strings.ToLower(strings.Join(strings.Fields(s), " "))
 }
 
 func (r *transactionRepo) IsDuplicate(ctx context.Context, date, description string, amount float64) (bool, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	var count int
 	err := r.db.QueryRow(ctx, `
 		SELECT COUNT(*) FROM transactions
-		WHERE date = $1 AND amount = $2 AND LOWER(description) = $3`,
-		date, amount, normalizeDesc(description)).Scan(&count)
+		WHERE date = $1 AND amount = $2 AND LOWER(description) = $3 AND profile_id = $4`,
+		date, amount, normalizeDesc(description), pid).Scan(&count)
 	return count > 0, err
 }
 
@@ -40,13 +41,16 @@ func (r *transactionRepo) IsExternalIDKnown(ctx context.Context, externalID stri
 	if externalID == "" {
 		return false, nil
 	}
+	pid := middleware.ProfileIDFromCtx(ctx)
 	var count int
 	err := r.db.QueryRow(ctx, `
-		SELECT COUNT(*) FROM transactions WHERE external_id = $1`, externalID).Scan(&count)
+		SELECT COUNT(*) FROM transactions WHERE external_id = $1 AND profile_id = $2`,
+		externalID, pid).Scan(&count)
 	return count > 0, err
 }
 
 func (r *transactionRepo) BulkInsert(ctx context.Context, rows []model.ImportRow) (int, error) {
+	pid := middleware.ProfileIDFromCtx(ctx)
 	tx, err := r.db.Begin(ctx)
 	if err != nil {
 		return 0, err
@@ -67,9 +71,9 @@ func (r *transactionRepo) BulkInsert(ctx context.Context, rows []model.ImportRow
 			origDate = &row.OriginalDate
 		}
 		_, err := tx.Exec(ctx, `
-			INSERT INTO transactions (date, original_date, amount, description, type, source, external_id, category_id)
-			VALUES ($1, $2, $3, $4, $5, 'import', $6, $7)`,
-			row.Date, origDate, row.Amount, row.Description, row.Type, extID, row.CategoryID)
+			INSERT INTO transactions (date, original_date, amount, description, type, source, external_id, category_id, profile_id)
+			VALUES ($1, $2, $3, $4, $5, 'import', $6, $7, $8)`,
+			row.Date, origDate, row.Amount, row.Description, row.Type, extID, row.CategoryID, pid)
 		if err != nil {
 			return count, err
 		}