Make Plaid credentials per-user, configurable via Settings UI

Plaid ClientId/Secret are now stored per-user in the database
(encrypted) instead of in appsettings.json. Users enter their own
Plaid developer credentials in the Settings > Bank Connections tab.

- New BankSyncSettings model (1:1 with User) for encrypted credentials
- PlaidSyncProvider is now stateless, receives credentials per-call
- Settings UI shows a credentials card with save form
- Connect via Plaid button disabled until credentials are configured
- Removed Plaid section from appsettings.json

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/services/bankSync.ts

@@ -5,10 +5,17 @@ import type {
   DiscoveredAccount,
   SyncResult,
   SyncLogEntry,
-  CreateLinkTokenResponse
+  CreateLinkTokenResponse,
+  PlaidCredentials
 } from '@/types'
 
 export const bankSyncApi = {
+  getPlaidCredentials: () =>
+    api.get<PlaidCredentials>('/bank-sync/plaid/credentials'),
+
+  savePlaidCredentials: (data: { clientId: string; secret: string; environment: string }) =>
+    api.post<PlaidCredentials>('/bank-sync/plaid/credentials', data),
+
   getConnections: () =>
     api.get<SyncConnection[]>('/bank-sync/connections'),