Make Plaid credentials per-user, configurable via Settings UI

Plaid ClientId/Secret are now stored per-user in the database
(encrypted) instead of in appsettings.json. Users enter their own
Plaid developer credentials in the Settings > Bank Connections tab.

- New BankSyncSettings model (1:1 with User) for encrypted credentials
- PlaidSyncProvider is now stateless, receives credentials per-call
- Settings UI shows a credentials card with save form
- Connect via Plaid button disabled until credentials are configured
- Removed Plaid section from appsettings.json

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/Purrse.Api/appsettings.json

@@ -18,11 +18,6 @@
   },
   "BankSync": {
     "EncryptionKey": "CHANGE_ME_32_CHAR_KEY_FOR_AES256!",
-    "Plaid": {
-      "ClientId": "",
-      "Secret": "",
-      "Environment": "sandbox"
-    },
     "DefaultSyncIntervalMinutes": 360,
     "BackgroundCheckIntervalMinutes": 15
   },