Make Plaid credentials per-user, configurable via Settings UI

Plaid ClientId/Secret are now stored per-user in the database
(encrypted) instead of in appsettings.json. Users enter their own
Plaid developer credentials in the Settings > Bank Connections tab.

- New BankSyncSettings model (1:1 with User) for encrypted credentials
- PlaidSyncProvider is now stateless, receives credentials per-call
- Settings UI shows a credentials card with save form
- Connect via Plaid button disabled until credentials are configured
- Removed Plaid section from appsettings.json

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/Purrse.Core/DTOs/BankSyncDtos.cs

@@ -2,6 +2,10 @@ using Purrse.Core.Enums;
 
 namespace Purrse.Core.DTOs;
 
+// Provider credentials
+public record SavePlaidCredentialsRequest(string ClientId, string Secret, string Environment);
+public record PlaidCredentialsResponse(bool IsConfigured, string Environment);
+
 // Plaid
 public record CreatePlaidConnectionRequest(string PublicToken);
 public record CreateLinkTokenResponse(string LinkToken, string Expiration);

src/Purrse.Core/Interfaces/Services/IBankSyncService.cs

@@ -10,6 +10,10 @@ public interface IBankSyncService
     Task<SyncConnectionResponse> UpdateConnectionAsync(Guid userId, Guid connectionId, UpdateConnectionRequest request);
     Task DeleteConnectionAsync(Guid userId, Guid connectionId);
 
+    // Provider credentials
+    Task<PlaidCredentialsResponse> GetPlaidCredentialsAsync(Guid userId);
+    Task<PlaidCredentialsResponse> SavePlaidCredentialsAsync(Guid userId, SavePlaidCredentialsRequest request);
+
     // Plaid flow
     Task<CreateLinkTokenResponse> CreatePlaidLinkTokenAsync(Guid userId);
     Task<SyncConnectionResponse> CompletePlaidLinkAsync(Guid userId, CreatePlaidConnectionRequest request);

src/Purrse.Core/Models/BankSyncSettings.cs

@@ -0,0 +1,13 @@
+namespace Purrse.Core.Models;
+
+public class BankSyncSettings
+{
+    public Guid Id { get; set; }
+    public Guid UserId { get; set; }
+    public string? EncryptedPlaidClientId { get; set; }
+    public string? EncryptedPlaidSecret { get; set; }
+    public string PlaidEnvironment { get; set; } = "sandbox";
+    public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
+
+    public User User { get; set; } = null!;
+}

src/Purrse.Core/Models/User.cs

@@ -13,4 +13,5 @@ public class User
 
     public ICollection<Account> Accounts { get; set; } = new List<Account>();
     public ICollection<SyncConnection> SyncConnections { get; set; } = new List<SyncConnection>();
+    public BankSyncSettings? BankSyncSettings { get; set; }
 }