Fix audit findings: budget editing, dead code, logging, multi-currency

- Add budget editing: updateBudget() API, edit button on budget cards,
  BudgetFormModal adapted for create/update (category locked on edit)
- Remove permanently-broken POST /auth/totp/verify stub and its unused
  TOTPVerifyRequest schema
- Wire getHoldingTransactions() to AssetDetail page — transaction history
  table now shows above the candlestick chart, sorted newest-first
- Fix multi-currency net worth in account_service: account balances are
  now converted to base_currency via ExchangeRate table before summing
- Replace silent bare pass exception handlers with logger.warning() in
  transactions.py (OCR/AI pipeline) and price_feed_service.py (search)
  — ValueError in date/number regex parsing left silent (control flow)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/account_service.py

@@ -9,6 +9,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.security import encrypt_field, decrypt_field
 from app.db.models.account import Account
+from app.db.models.currency import ExchangeRate
 from app.db.models.transaction import Transaction
 from app.schemas.account import AccountCreate, AccountUpdate
 
@@ -168,6 +169,19 @@ async def recalculate_balance(db: AsyncSession, account_id: uuid.UUID) -> None:
     await db.flush()
 
 
+async def _fx_rate(db: AsyncSession, from_currency: str, to_currency: str) -> Decimal:
+    if from_currency == to_currency:
+        return Decimal("1")
+    result = await db.execute(
+        select(ExchangeRate)
+        .where(ExchangeRate.base_currency == from_currency, ExchangeRate.quote_currency == to_currency)
+        .order_by(ExchangeRate.fetched_at.desc())
+        .limit(1)
+    )
+    er = result.scalar_one_or_none()
+    return er.rate if er else Decimal("1")
+
+
 async def get_net_worth(db: AsyncSession, user_id: uuid.UUID, base_currency: str) -> dict:
     accounts = await db.execute(
         select(Account).where(
@@ -180,8 +194,11 @@ async def get_net_worth(db: AsyncSession, user_id: uuid.UUID, base_currency: str
     total_liabilities = Decimal("0")
 
     for account in accounts.scalars():
-        # TODO Phase 3: convert to base_currency via FX rates
-        bal = account.current_balance
+        bal = account.current_balance or Decimal("0")
+        acct_currency = account.currency or base_currency
+        if acct_currency != base_currency:
+            rate = await _fx_rate(db, acct_currency, base_currency)
+            bal = bal * rate
         if account.type in LIABILITY_TYPES:
             total_liabilities += abs(bal)
         else:

backend/app/services/price_feed_service.py

@@ -118,6 +118,6 @@ def search_yahoo(query: str) -> list[dict]:
                 "data_source_id": None,
             })
         return out
-    except Exception:
-        pass
+    except Exception as exc:
+        logger.warning("yahoo_search_failed", query=query, error=str(exc))
     return []