Add AI receipt parsing with provider API key settings

- Settings → AI: configure Anthropic or OpenAI provider with encrypted API key
- Sparkle button on each attachment in transaction drawer sends image/PDF to AI
- AI extracts merchant, amount, date, description, category hint
- "Apply to transaction" button patches the transaction with parsed fields
- Anthropic supports images and PDFs; OpenAI supports images only
- API key stored AES-256-GCM encrypted in users table (migration 0003)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/alembic/versions/0003_ai_settings.py

@@ -0,0 +1,23 @@
+"""add ai_provider and ai_api_key_enc to users
+
+Revision ID: 0003
+Revises: 0002
+Create Date: 2026-04-22
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0003"
+down_revision = "0002"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("users", sa.Column("ai_provider", sa.Text, nullable=True))
+    op.add_column("users", sa.Column("ai_api_key_enc", sa.LargeBinary, nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("users", "ai_api_key_enc")
+    op.drop_column("users", "ai_provider")