feat: remove OTP gate from transactions, fix categories auth, add implementation plan

- Remove OtpGateGuard from transactions controller (OTP verified at login)
- Fix categories controller to use authenticated user instead of TEMP_USER_ID
- Add comprehensive implementation plan document
- Update .env.example with WEB_APP_URL
- Prepare for admin dashboard development

apps/api/dist/auth/auth.controller.d.ts

@@ -0,0 +1,83 @@
+import { AuthService } from './auth.service';
+import type { Response } from 'express';
+interface RequestWithUser {
+    user: {
+        userId: string;
+        email: string;
+    };
+}
+export declare class AuthController {
+    private authService;
+    constructor(authService: AuthService);
+    register(body: {
+        email: string;
+        password: string;
+        name?: string;
+    }): Promise<{
+        user: {
+            id: string;
+            email: string;
+            name: string | null;
+            avatarUrl: string | null;
+            emailVerified: boolean;
+        };
+        token: string;
+    }>;
+    login(body: {
+        email: string;
+        password: string;
+    }): Promise<{
+        requiresOtp: boolean;
+        availableMethods: {
+            email: boolean;
+            whatsapp: boolean;
+            totp: boolean;
+        };
+        tempToken: string;
+        user?: undefined;
+        token?: undefined;
+    } | {
+        user: {
+            id: string;
+            email: string;
+            name: string | null;
+            avatarUrl: string | null;
+            emailVerified: boolean;
+        };
+        token: string;
+        requiresOtp?: undefined;
+        availableMethods?: undefined;
+        tempToken?: undefined;
+    }>;
+    verifyOtp(body: {
+        tempToken: string;
+        otpCode: string;
+        method: 'email' | 'totp';
+    }): Promise<{
+        user: {
+            id: string;
+            email: string;
+            name: string | null;
+            avatarUrl: string | null;
+            emailVerified: boolean;
+        };
+        token: string;
+    }>;
+    googleAuth(): Promise<void>;
+    googleAuthCallback(req: any, res: Response): Promise<void>;
+    getProfile(req: RequestWithUser): Promise<{
+        id: string;
+        email: string;
+        emailVerified: boolean;
+        name: string | null;
+        avatarUrl: string | null;
+    }>;
+    changePassword(req: RequestWithUser, body: {
+        currentPassword: string;
+        newPassword: string;
+        isSettingPassword?: boolean;
+    }): Promise<{
+        message: string;
+    }>;
+}
+export {};