feat: remove OTP gate from transactions, fix categories auth, add implementation plan

- Remove OtpGateGuard from transactions controller (OTP verified at login)
- Fix categories controller to use authenticated user instead of TEMP_USER_ID
- Add comprehensive implementation plan document
- Update .env.example with WEB_APP_URL
- Prepare for admin dashboard development

apps/api/dist/auth/auth.guard.js

@@ -11,39 +11,28 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthGuard = void 0;
 const common_1 = require("@nestjs/common");
-const firebase_service_1 = require("./firebase.service");
-let AuthGuard = class AuthGuard {
-    firebaseService;
-    constructor(firebaseService) {
-        this.firebaseService = firebaseService;
+const core_1 = require("@nestjs/core");
+const passport_1 = require("@nestjs/passport");
+let AuthGuard = class AuthGuard extends (0, passport_1.AuthGuard)('jwt') {
+    reflector;
+    constructor(reflector) {
+        super();
+        this.reflector = reflector;
     }
-    async canActivate(context) {
-        const request = context.switchToHttp().getRequest();
-        if (!this.firebaseService.isFirebaseConfigured()) {
-            console.warn('⚠️ Firebase not configured - allowing request without auth');
+    canActivate(context) {
+        const isPublic = this.reflector.getAllAndOverride('isPublic', [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (isPublic) {
             return true;
         }
-        const token = this.extractTokenFromHeader(request);
-        if (!token) {
-            throw new common_1.UnauthorizedException('No token provided');
-        }
-        try {
-            const decodedToken = await this.firebaseService.verifyIdToken(token);
-            request.user = decodedToken;
-            return true;
-        }
-        catch (error) {
-            throw new common_1.UnauthorizedException('Invalid token');
-        }
-    }
-    extractTokenFromHeader(request) {
-        const [type, token] = request.headers.authorization?.split(' ') ?? [];
-        return type === 'Bearer' ? token : undefined;
+        return super.canActivate(context);
     }
 };
 exports.AuthGuard = AuthGuard;
 exports.AuthGuard = AuthGuard = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [firebase_service_1.FirebaseService])
+    __metadata("design:paramtypes", [core_1.Reflector])
 ], AuthGuard);
 //# sourceMappingURL=auth.guard.js.map