Make Plaid credentials per-user, configurable via Settings UI

Plaid ClientId/Secret are now stored per-user in the database
(encrypted) instead of in appsettings.json. Users enter their own
Plaid developer credentials in the Settings > Bank Connections tab.

- New BankSyncSettings model (1:1 with User) for encrypted credentials
- PlaidSyncProvider is now stateless, receives credentials per-call
- Settings UI shows a credentials card with save form
- Connect via Plaid button disabled until credentials are configured
- Removed Plaid section from appsettings.json

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/Purrse.Data/Configurations/SyncConnectionConfiguration.cs

@@ -53,6 +53,25 @@ public class LinkedAccountConfiguration : IEntityTypeConfiguration<LinkedAccount
     }
 }
 
+public class BankSyncSettingsConfiguration : IEntityTypeConfiguration<BankSyncSettings>
+{
+    public void Configure(EntityTypeBuilder<BankSyncSettings> builder)
+    {
+        builder.ToTable("bank_sync_settings");
+        builder.HasKey(s => s.Id);
+        builder.Property(s => s.EncryptedPlaidClientId).HasColumnType("text");
+        builder.Property(s => s.EncryptedPlaidSecret).HasColumnType("text");
+        builder.Property(s => s.PlaidEnvironment).HasMaxLength(20);
+
+        builder.HasOne(s => s.User)
+            .WithOne(u => u.BankSyncSettings)
+            .HasForeignKey<BankSyncSettings>(s => s.UserId)
+            .OnDelete(DeleteBehavior.Cascade);
+
+        builder.HasIndex(s => s.UserId).IsUnique();
+    }
+}
+
 public class SyncLogConfiguration : IEntityTypeConfiguration<SyncLog>
 {
     public void Configure(EntityTypeBuilder<SyncLog> builder)

src/Purrse.Data/Migrations/20260208215030_AddBankSyncSettings.cs

@@ -0,0 +1,50 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Purrse.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddBankSyncSettings : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "bank_sync_settings",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uuid", nullable: false),
+                    UserId = table.Column<Guid>(type: "uuid", nullable: false),
+                    EncryptedPlaidClientId = table.Column<string>(type: "text", nullable: true),
+                    EncryptedPlaidSecret = table.Column<string>(type: "text", nullable: true),
+                    PlaidEnvironment = table.Column<string>(type: "character varying(20)", maxLength: 20, nullable: false),
+                    UpdatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_bank_sync_settings", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_bank_sync_settings_users_UserId",
+                        column: x => x.UserId,
+                        principalTable: "users",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_bank_sync_settings_UserId",
+                table: "bank_sync_settings",
+                column: "UserId",
+                unique: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "bank_sync_settings");
+        }
+    }
+}

src/Purrse.Data/Migrations/PurrseDbContextModelSnapshot.cs

@@ -127,6 +127,37 @@ namespace Purrse.Data.Migrations
                     b.ToTable("amortization_entries", (string)null);
                 });
 
+            modelBuilder.Entity("Purrse.Core.Models.BankSyncSettings", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("EncryptedPlaidClientId")
+                        .HasColumnType("text");
+
+                    b.Property<string>("EncryptedPlaidSecret")
+                        .HasColumnType("text");
+
+                    b.Property<string>("PlaidEnvironment")
+                        .IsRequired()
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)");
+
+                    b.Property<DateTime>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId")
+                        .IsUnique();
+
+                    b.ToTable("bank_sync_settings", (string)null);
+                });
+
             modelBuilder.Entity("Purrse.Core.Models.Budget", b =>
                 {
                     b.Property<Guid>("Id")
@@ -974,6 +1005,17 @@ namespace Purrse.Data.Migrations
                     b.Navigation("LoanDetail");
                 });
 
+            modelBuilder.Entity("Purrse.Core.Models.BankSyncSettings", b =>
+                {
+                    b.HasOne("Purrse.Core.Models.User", "User")
+                        .WithOne("BankSyncSettings")
+                        .HasForeignKey("Purrse.Core.Models.BankSyncSettings", "UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
             modelBuilder.Entity("Purrse.Core.Models.Budget", b =>
                 {
                     b.HasOne("Purrse.Core.Models.User", "User")
@@ -1354,6 +1396,8 @@ namespace Purrse.Data.Migrations
                 {
                     b.Navigation("Accounts");
 
+                    b.Navigation("BankSyncSettings");
+
                     b.Navigation("SyncConnections");
                 });
 #pragma warning restore 612, 618

src/Purrse.Data/PurrseDbContext.cs

@@ -29,6 +29,7 @@ public class PurrseDbContext : DbContext
     public DbSet<SyncConnection> SyncConnections => Set<SyncConnection>();
     public DbSet<LinkedAccount> LinkedAccounts => Set<LinkedAccount>();
     public DbSet<SyncLog> SyncLogs => Set<SyncLog>();
+    public DbSet<BankSyncSettings> BankSyncSettings => Set<BankSyncSettings>();
 
     protected override void OnModelCreating(ModelBuilder modelBuilder)
     {