feat: remove OTP gate from transactions, fix categories auth, add implementation plan

- Remove OtpGateGuard from transactions controller (OTP verified at login)
- Fix categories controller to use authenticated user instead of TEMP_USER_ID
- Add comprehensive implementation plan document
- Update .env.example with WEB_APP_URL
- Prepare for admin dashboard development

apps/api/dist/auth/google.strategy.d.ts

@@ -0,0 +1,9 @@
+import { Strategy, VerifyCallback } from 'passport-google-oauth20';
+declare const GoogleStrategy_base: new (...args: [options: import("passport-google-oauth20").StrategyOptionsWithRequest] | [options: import("passport-google-oauth20").StrategyOptions] | [options: import("passport-google-oauth20").StrategyOptions] | [options: import("passport-google-oauth20").StrategyOptionsWithRequest]) => Strategy & {
+    validate(...args: any[]): unknown;
+};
+export declare class GoogleStrategy extends GoogleStrategy_base {
+    constructor();
+    validate(accessToken: string, refreshToken: string, profile: any, done: VerifyCallback): Promise<any>;
+}
+export {};