feat: multi-account financial overview dashboard (#132)

[sinatragian]

Adds multi-account financial overview dashboard to fix #132.

Backend

• Full CRUD under /accounts (list, create, get, update, soft-delete)
• GET /accounts/overview — single GROUP BY query aggregates income/expenses per account; returns per-account balance + {total_assets, total_liabilities, net_worth, unassigned_income, unassigned_expenses, account_count}
• Account types: BANK, CREDIT, CASH, INVESTMENT, WALLET, OTHER
• updated_at column with Postgres trigger; soft-delete preserves historical expense links
• All queries scoped to user_id — no cross-tenant data exposure possible

Frontend

• /accounts — Accounts page:
  • 4 summary metric cards: Total Assets, Total Liabilities, Net Worth (green/red), Account Count
  • Accounts list with type badge, currency, color swatch, calculated balance
  • "New Account" dialog: name, type (select), currency, initial_balance, color
  • Inline edit (PATCH) and soft-delete per account
  • Loading skeletons, empty state, toast notifications
• Wired into React Router and navbar
• Files: app/src/api/accounts.ts (full API layer), app/src/pages/Accounts.tsx, route in App.tsx, nav link in Navbar.tsx

Security note

Every query is scoped to the authenticated user's user_id — list, get, overview GROUP BY, and unassigned totals. A valid JWT for user A cannot read or infer user B's account balances even with a guessed account_id.

Closes #132

[sinatragian]

Security note — user_id isolation in all financial queries

Every query in this implementation is scoped to the authenticated user's user_id:

• GET /accounts → filter_by(user_id=uid, active=True)
• GET /accounts/<id> → _get_or_404 checks both acc.user_id != user_id and acc.active
• GET /accounts/overview → the GROUP BY aggregation filters Expense.user_id == uid before joining; no row from another user can appear in the result
• Unassigned-expense totals also filter by Expense.user_id == uid

This means a valid JWT for user A cannot be used to read, modify, or infer the balance of user B's accounts — even if the account_id is guessed.