Make Plaid credentials per-user, configurable via Settings UI

Plaid ClientId/Secret are now stored per-user in the database
(encrypted) instead of in appsettings.json. Users enter their own
Plaid developer credentials in the Settings > Bank Connections tab.

- New BankSyncSettings model (1:1 with User) for encrypted credentials
- PlaidSyncProvider is now stateless, receives credentials per-call
- Settings UI shows a credentials card with save form
- Connect via Plaid button disabled until credentials are configured
- Removed Plaid section from appsettings.json

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/Purrse.Core/Models/BankSyncSettings.cs

@@ -0,0 +1,13 @@
+namespace Purrse.Core.Models;
+
+public class BankSyncSettings
+{
+    public Guid Id { get; set; }
+    public Guid UserId { get; set; }
+    public string? EncryptedPlaidClientId { get; set; }
+    public string? EncryptedPlaidSecret { get; set; }
+    public string PlaidEnvironment { get; set; } = "sandbox";
+    public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
+
+    public User User { get; set; } = null!;
+}

src/Purrse.Core/Models/User.cs

@@ -13,4 +13,5 @@ public class User
 
     public ICollection<Account> Accounts { get; set; } = new List<Account>();
     public ICollection<SyncConnection> SyncConnections { get; set; } = new List<SyncConnection>();
+    public BankSyncSettings? BankSyncSettings { get; set; }
 }