Make Plaid credentials per-user, configurable via Settings UI

Plaid ClientId/Secret are now stored per-user in the database
(encrypted) instead of in appsettings.json. Users enter their own
Plaid developer credentials in the Settings > Bank Connections tab.

- New BankSyncSettings model (1:1 with User) for encrypted credentials
- PlaidSyncProvider is now stateless, receives credentials per-call
- Settings UI shows a credentials card with save form
- Connect via Plaid button disabled until credentials are configured
- Removed Plaid section from appsettings.json

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/Purrse.Api/Controllers/BankSyncController.cs

@@ -35,6 +35,14 @@ public class BankSyncController : ControllerBase
         return NoContent();
     }
 
+    [HttpGet("plaid/credentials")]
+    public async Task<ActionResult<PlaidCredentialsResponse>> GetPlaidCredentials()
+        => Ok(await _bankSyncService.GetPlaidCredentialsAsync(UserId));
+
+    [HttpPost("plaid/credentials")]
+    public async Task<ActionResult<PlaidCredentialsResponse>> SavePlaidCredentials(SavePlaidCredentialsRequest request)
+        => Ok(await _bankSyncService.SavePlaidCredentialsAsync(UserId, request));
+
     [HttpPost("plaid/create-link-token")]
     public async Task<ActionResult<CreateLinkTokenResponse>> CreatePlaidLinkToken()
         => Ok(await _bankSyncService.CreatePlaidLinkTokenAsync(UserId));