feat: remove OTP gate from transactions, fix categories auth, add implementation plan

- Remove OtpGateGuard from transactions controller (OTP verified at login)
- Fix categories controller to use authenticated user instead of TEMP_USER_ID
- Add comprehensive implementation plan document
- Update .env.example with WEB_APP_URL
- Prepare for admin dashboard development

PROFILE_FIXES.md

@@ -0,0 +1,31 @@
+# Profile Page Fixes Summary
+
+## Issues to Fix:
+1. ✅ Display user name and avatar (fixed in sidebar)
+2. ✅ Logout button works (fixed in sidebar)
+3. ⏳ Add change password section
+4. ⏳ Fix QR code display for Google Authenticator
+5. ⏳ Fix user info display in Profile page
+
+## Changes Made:
+
+### Backend:
+1. ✅ Added `/api/auth/me` endpoint that returns full user profile
+2. ✅ Fixed wallets controller to use userId from JWT
+3. ✅ Fixed transactions controller to use userId from JWT
+4. ✅ All 500 errors resolved
+
+### Frontend:
+1. ✅ Fixed logout button in AppSidebar
+2. ✅ Display user name and avatar in sidebar
+3. ⏳ Need to update Profile page to:
+   - Show user name and avatar at top
+   - Add change password form
+   - Fix QR code display (use img tag with data URL)
+   - Fix user?.displayName to user?.name
+
+## Next Steps:
+1. Update Profile.tsx to use correct user fields
+2. Add change password form
+3. Fix QR code display
+4. Test complete flow