Complete Phase 3, Phase 5 polish and hardening

Phase 3 — Investments:
- Multi-currency support: holdings track purchase currency, FX rates convert to base for totals
- Capital gains report using UK Section 104 pool method, grouped by tax year
- Capital Gains tab added to Reports page

Phase 5 — Polish & Hardening:
- Mobile-responsive layout: bottom nav, sidebar hidden on mobile, logo in TopBar, compact header buttons, hover-only actions now always visible on touch
- Backup system: encrypted GPG backups via backup.sh, nightly scheduler job, admin API (list/trigger/download/restore), Settings UI with drag-to-restore confirmation
- Docker entrypoint with gosu privilege drop to fix bind-mount ownership on fresh deployments
- OWASP fixes: refresh token now bound to its session (new refresh_token_hash column + migration), CSRF secure flag tied to environment, IP-level rate limiting on login, TOTPEnableRequest Pydantic schema replaces raw dict
- AES-256-GCM key rotation script (rotate_keys.py) with dry-run mode and atomic DB transaction
- CLAUDE.md added for AI-assisted development context
- README updated: correct reverse proxy port, accurate backup/restore commands, key rotation instructions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/api/v1/reports.py

@@ -12,6 +12,7 @@ from app.schemas.report import (
     CategoryBreakdownReport,
     IncomeExpenseReport,
     NetWorthReport,
+    SavingsRateReport,
     SpendingTrendsReport,
 )
 from app.services import report_service
@@ -83,6 +84,15 @@ async def spending_trends(
     return await report_service.get_spending_trends(db, current_user.id, months)
 
 
+@router.get("/savings-rate", response_model=SavingsRateReport)
+async def savings_rate(
+    months: int = Query(default=12, ge=1, le=60),
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
+    return await report_service.get_savings_rate_report(db, current_user.id, months)
+
+
 @router.get("/balance-sheet", response_model=BalanceSheetReport)
 async def balance_sheet(
     db: AsyncSession = Depends(get_db),