Add AI receipt scanning with OCR pipeline and debug toggle

- OCR pipeline: Tesseract (images) + pdfplumber (PDFs) → AI text prompt →
  rule-based regex fallback; works with any text model, not just vision models
- Scan Receipt toolbar button parses a photo and pre-fills the transaction form;
  receipt image is automatically attached to the created transaction
- AI settings page: provider, API key (AES-256-GCM encrypted), custom URL,
  model, and per-user debug toggle that gates the OCR/AI debug panel
- Fix CSRF cookie secure=False so HTTP deployments work; add 7-day max_age
- Fix attachment_refs missing from _to_response (attachments never appeared in UI)
- Fix multipart boundary lost when Content-Type was set manually in axios calls
- nginx: raise client_max_body_size to 15 MB, add 120s proxy timeout for OCR
- Migration 0005: add ai_debug boolean to users table
- Update README and CLAUDE.md with AI scanning docs and architecture notes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/api/v1/settings.py

@@ -22,6 +22,7 @@ class AiSettingsResponse(BaseModel):
     has_api_key: bool
     base_url: str | None
     model: str | None
+    debug: bool
 
 
 class AiSettingsSave(BaseModel):
@@ -29,6 +30,7 @@ class AiSettingsSave(BaseModel):
     api_key: str = ""
     base_url: str = ""
     model: str = ""
+    debug: bool = False
 
 
 @router.get("/ai", response_model=AiSettingsResponse)
@@ -38,6 +40,7 @@ async def get_ai_settings(user: User = Depends(get_current_user)):
         has_api_key=bool(user.ai_api_key_enc),
         base_url=user.ai_base_url,
         model=user.ai_model,
+        debug=user.ai_debug,
     )
 
 
@@ -54,6 +57,7 @@ async def save_ai_settings(
         "ai_provider": body.provider,
         "ai_base_url": body.base_url.rstrip("/") or None,
         "ai_model": body.model.strip() or None,
+        "ai_debug": body.debug,
     }
 
     if body.api_key.strip():
@@ -68,6 +72,7 @@ async def save_ai_settings(
         has_api_key=True,
         base_url=values["ai_base_url"],
         model=values["ai_model"],
+        debug=body.debug,
     )