Complete Phase 3, Phase 5 polish and hardening

Phase 3 — Investments:
- Multi-currency support: holdings track purchase currency, FX rates convert to base for totals
- Capital gains report using UK Section 104 pool method, grouped by tax year
- Capital Gains tab added to Reports page

Phase 5 — Polish & Hardening:
- Mobile-responsive layout: bottom nav, sidebar hidden on mobile, logo in TopBar, compact header buttons, hover-only actions now always visible on touch
- Backup system: encrypted GPG backups via backup.sh, nightly scheduler job, admin API (list/trigger/download/restore), Settings UI with drag-to-restore confirmation
- Docker entrypoint with gosu privilege drop to fix bind-mount ownership on fresh deployments
- OWASP fixes: refresh token now bound to its session (new refresh_token_hash column + migration), CSRF secure flag tied to environment, IP-level rate limiting on login, TOTPEnableRequest Pydantic schema replaces raw dict
- AES-256-GCM key rotation script (rotate_keys.py) with dry-run mode and atomic DB transaction
- CLAUDE.md added for AI-assisted development context
- README updated: correct reverse proxy port, accurate backup/restore commands, key rotation instructions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/schemas/auth.py

@@ -52,6 +52,11 @@ class TOTPVerifyRequest(BaseModel):
     code: str
 
 
+class TOTPEnableRequest(BaseModel):
+    secret: str
+    code: str
+
+
 class SessionInfo(BaseModel):
     id: uuid.UUID
     ip_address: str | None

backend/app/schemas/investment.py

@@ -101,3 +101,28 @@ class PerformanceMetrics(BaseModel):
     total_return: Decimal
     total_return_pct: Decimal
     currency: str
+
+
+class CapitalGainsDisposal(BaseModel):
+    date: DateType
+    symbol: str
+    asset_name: str
+    quantity: Decimal
+    proceeds: Decimal
+    cost: Decimal
+    gain: Decimal
+    currency: str
+
+
+class TaxYearSummary(BaseModel):
+    tax_year: str
+    disposals: list[CapitalGainsDisposal]
+    total_proceeds: Decimal
+    total_cost: Decimal
+    total_gain: Decimal
+    currency: str
+
+
+class CapitalGainsReport(BaseModel):
+    tax_years: list[TaxYearSummary]
+    currency: str

backend/app/schemas/report.py

@@ -96,6 +96,20 @@ class SpendingTrendsReport(BaseModel):
     currency: str
 
 
+class SavingsRatePoint(BaseModel):
+    month: str
+    income: Decimal
+    expenses: Decimal
+    savings: Decimal
+    savings_rate: Decimal
+
+
+class SavingsRateReport(BaseModel):
+    points: list[SavingsRatePoint]
+    avg_savings_rate: Decimal
+    currency: str
+
+
 class BalanceSheetAccount(BaseModel):
     id: str
     name: str

backend/app/schemas/transaction.py

@@ -48,6 +48,7 @@ class TransactionFilter(BaseModel):
     max_amount: Decimal | None = None
     search: str | None = None
     tags: list[str] = []
+    is_recurring: bool | None = None
     page: int = Field(default=1, ge=1)
     page_size: int = Field(default=50, ge=1, le=200)