Major feature release: security hardening + Goals, Rules, search, charts

Security:
- Replace SHA-256 password hashing with bcrypt (cost 12) + timing-safe compare
- Introduce server-side session tokens (x-session-token header); drop x-user-id
- Add /api/auth/logout endpoint to invalidate sessions
- Enforce 8-char minimum password server-side
- Fix password reset: now uses real signed tokens with 1-hour TTL

Features:
- Goals: savings goals with progress bars, target dates, add/withdraw funds
- Auto-categorization Rules: keyword → envelope mapping applied on transaction add
- Transaction search/filter: description, account, envelope, date range
- Transaction table: shows envelope color dot, running balance column
- Monthly Spending History chart (last 6 months income vs expenses bar chart)
- Spending Insights: month-over-month comparison + overspent envelope callouts
- Budget progress expanded: per-envelope bars with rollover indicator
- Envelope rollover toggle: unspent funds can carry forward
- Recurring transactions auto-applied on login
- Save indicator in nav (Saving… / Saved ✓ / Save failed)
- Nav overflow fixed: all tabs scroll horizontally instead of clipping
- PWA manifest added for home-screen install support

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app/api/auth/delete-account/route.ts

@@ -2,24 +2,16 @@ import { NextRequest, NextResponse } from 'next/server';
 import { FileStorageService } from '@/lib/fileStorage';
 
 export async function POST(request: NextRequest) {
+  const token = request.headers.get('x-session-token');
+  if (!token) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+
+  const session = await FileStorageService.validateSession(token);
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+
   try {
-    const userId = request.headers.get('x-user-id');
-
-    if (!userId) {
-      return NextResponse.json(
-        { error: 'User ID is required' },
-        { status: 401 }
-      );
-    }
-
-    // Delete user account and all data
-    await FileStorageService.deleteUser(userId);
-
+    await FileStorageService.deleteUser(session.userId, token);
     return NextResponse.json({ success: true, message: 'Account deleted successfully' });
   } catch (error: any) {
-    return NextResponse.json(
-      { error: error.message || 'Account deletion failed' },
-      { status: 500 }
-    );
+    return NextResponse.json({ error: error.message || 'Account deletion failed' }, { status: 500 });
   }
 }