Complete Phase 3, Phase 5 polish and hardening

Phase 3 — Investments:
- Multi-currency support: holdings track purchase currency, FX rates convert to base for totals
- Capital gains report using UK Section 104 pool method, grouped by tax year
- Capital Gains tab added to Reports page

Phase 5 — Polish & Hardening:
- Mobile-responsive layout: bottom nav, sidebar hidden on mobile, logo in TopBar, compact header buttons, hover-only actions now always visible on touch
- Backup system: encrypted GPG backups via backup.sh, nightly scheduler job, admin API (list/trigger/download/restore), Settings UI with drag-to-restore confirmation
- Docker entrypoint with gosu privilege drop to fix bind-mount ownership on fresh deployments
- OWASP fixes: refresh token now bound to its session (new refresh_token_hash column + migration), CSRF secure flag tied to environment, IP-level rate limiting on login, TOTPEnableRequest Pydantic schema replaces raw dict
- AES-256-GCM key rotation script (rotate_keys.py) with dry-run mode and atomic DB transaction
- CLAUDE.md added for AI-assisted development context
- README updated: correct reverse proxy port, accurate backup/restore commands, key rotation instructions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/scripts/backup.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# backup.sh — pg_dump | gzip | gpg encrypt → /backups/
+# Run inside the backend container:
+#   docker compose exec backend bash /app/scripts/backup.sh
+# Or from host:
+#   docker compose exec -e BACKUP_PASSPHRASE="$BACKUP_PASSPHRASE" backend bash scripts/backup.sh
+set -euo pipefail
+
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+BACKUP_DIR="${BACKUP_DIR:-/app/backups}"
+BACKUP_FILE="${BACKUP_DIR}/${TIMESTAMP}.sql.gz.gpg"
+RETENTION_DAYS="${BACKUP_RETENTION_DAYS:-30}"
+
+# Require passphrase
+if [ -z "${BACKUP_PASSPHRASE:-}" ]; then
+  echo "[backup] ERROR: BACKUP_PASSPHRASE is not set" >&2
+  exit 1
+fi
+
+mkdir -p "${BACKUP_DIR}"
+echo "[backup] Starting at ${TIMESTAMP}"
+
+# GPG needs a writable home dir; appuser has no real home
+export GNUPGHOME=/tmp/.gnupg
+mkdir -p "${GNUPGHOME}"
+chmod 700 "${GNUPGHOME}"
+
+# pg_dump using the DATABASE_URL but swap asyncpg driver for psycopg2-compatible URL
+PG_URL="${DATABASE_URL/postgresql+asyncpg/postgresql}"
+
+pg_dump --clean --if-exists "${PG_URL}" \
+  | gzip \
+  | gpg --batch --yes --no-symkey-cache --pinentry-mode loopback \
+        --symmetric --cipher-algo AES256 \
+        --passphrase "${BACKUP_PASSPHRASE}" \
+        --output "${BACKUP_FILE}"
+
+SIZE=$(du -sh "${BACKUP_FILE}" | cut -f1)
+echo "[backup] Written ${SIZE} → ${BACKUP_FILE}"
+
+# List current backups
+COUNT=$(find "${BACKUP_DIR}" -name "*.sql.gz.gpg" | wc -l)
+echo "[backup] ${COUNT} backup(s) on disk"
+
+# Prune old backups
+PRUNED=$(find "${BACKUP_DIR}" -name "*.sql.gz.gpg" -mtime "+${RETENTION_DAYS}" -print -delete | wc -l)
+if [ "${PRUNED}" -gt 0 ]; then
+  echo "[backup] Pruned ${PRUNED} backup(s) older than ${RETENTION_DAYS} days"
+fi
+
+echo "[backup] Done"