Complete Phase 3, Phase 5 polish and hardening

Phase 3 — Investments:
- Multi-currency support: holdings track purchase currency, FX rates convert to base for totals
- Capital gains report using UK Section 104 pool method, grouped by tax year
- Capital Gains tab added to Reports page

Phase 5 — Polish & Hardening:
- Mobile-responsive layout: bottom nav, sidebar hidden on mobile, logo in TopBar, compact header buttons, hover-only actions now always visible on touch
- Backup system: encrypted GPG backups via backup.sh, nightly scheduler job, admin API (list/trigger/download/restore), Settings UI with drag-to-restore confirmation
- Docker entrypoint with gosu privilege drop to fix bind-mount ownership on fresh deployments
- OWASP fixes: refresh token now bound to its session (new refresh_token_hash column + migration), CSRF secure flag tied to environment, IP-level rate limiting on login, TOTPEnableRequest Pydantic schema replaces raw dict
- AES-256-GCM key rotation script (rotate_keys.py) with dry-run mode and atomic DB transaction
- CLAUDE.md added for AI-assisted development context
- README updated: correct reverse proxy port, accurate backup/restore commands, key rotation instructions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/workers/scheduler.py

@@ -15,12 +15,13 @@ async def start_scheduler() -> None:
     from app.workers.snapshot import snapshot_job
     from app.workers.price_sync import price_sync_job
     from app.workers.fx_sync import fx_sync_job
+    from app.workers.backup import backup_job
     _scheduler = AsyncIOScheduler()
 
     _scheduler.add_job(snapshot_job,   CronTrigger(hour=2, minute=0),   id="nw_snapshot")
     _scheduler.add_job(price_sync_job, CronTrigger(minute="*/15"),       id="price_sync")
     _scheduler.add_job(fx_sync_job,    CronTrigger(minute=0),            id="fx_sync")
-    # _scheduler.add_job(backup_job,     CronTrigger(hour=3),             id="backup")
+    _scheduler.add_job(backup_job,     CronTrigger(hour=3, minute=0),    id="backup")
     # _scheduler.add_job(ml_retrain_job, CronTrigger(day_of_week="sun", hour=1), id="ml_retrain")
 
     _scheduler.start()