Add AI receipt scanning with OCR pipeline and debug toggle

- OCR pipeline: Tesseract (images) + pdfplumber (PDFs) → AI text prompt →
  rule-based regex fallback; works with any text model, not just vision models
- Scan Receipt toolbar button parses a photo and pre-fills the transaction form;
  receipt image is automatically attached to the created transaction
- AI settings page: provider, API key (AES-256-GCM encrypted), custom URL,
  model, and per-user debug toggle that gates the OCR/AI debug panel
- Fix CSRF cookie secure=False so HTTP deployments work; add 7-day max_age
- Fix attachment_refs missing from _to_response (attachments never appeared in UI)
- Fix multipart boundary lost when Content-Type was set manually in axios calls
- nginx: raise client_max_body_size to 15 MB, add 120s proxy timeout for OCR
- Migration 0005: add ai_debug boolean to users table
- Update README and CLAUDE.md with AI scanning docs and architecture notes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/api/settings.ts

@@ -5,6 +5,7 @@ export interface AiSettings {
   has_api_key: boolean;
   base_url: string | null;
   model: string | null;
+  debug: boolean;
 }
 
 export interface AiSettingsSave {
@@ -12,6 +13,7 @@ export interface AiSettingsSave {
   api_key?: string;
   base_url?: string;
   model?: string;
+  debug?: boolean;
 }
 
 export interface ParsedReceipt {
@@ -22,6 +24,7 @@ export interface ParsedReceipt {
   description: string | null;
   category: string | null;
   raw: string | null;
+  ocr_text: string | null;
 }
 
 export async function getAiSettings(): Promise<AiSettings> {
@@ -51,8 +54,7 @@ export async function parseReceipt(txnId: string, attachmentId: string): Promise
 export async function parseReceiptFile(file: File): Promise<ParsedReceipt> {
   const form = new FormData();
   form.append("file", file);
-  const { data } = await api.post("/transactions/parse-receipt", form, {
-    headers: { "Content-Type": "multipart/form-data" },
-  });
+  // Do NOT set Content-Type manually — axios sets it with the multipart boundary automatically
+  const { data } = await api.post("/transactions/parse-receipt", form);
   return data;
 }

frontend/src/api/transactions.ts

@@ -113,9 +113,8 @@ export async function importCsv(
 export async function uploadAttachment(txnId: string, file: File): Promise<AttachmentRef> {
   const form = new FormData();
   form.append("file", file);
-  const res = await api.post(`/transactions/${txnId}/attachments`, form, {
-    headers: { "Content-Type": "multipart/form-data" },
-  });
+  // Do NOT set Content-Type manually — axios sets it with the multipart boundary automatically
+  const res = await api.post(`/transactions/${txnId}/attachments`, form);
   return res.data;
 }