feat: remove OTP gate from transactions, fix categories auth, add implementation plan

- Remove OtpGateGuard from transactions controller (OTP verified at login)
- Fix categories controller to use authenticated user instead of TEMP_USER_ID
- Add comprehensive implementation plan document
- Update .env.example with WEB_APP_URL
- Prepare for admin dashboard development

apps/api/dist/otp/otp.controller.d.ts

@@ -0,0 +1,92 @@
+import { JwtService } from '@nestjs/jwt';
+import { OtpService } from './otp.service';
+export declare const IS_PUBLIC_KEY = "isPublic";
+export declare const Public: () => import("@nestjs/common").CustomDecorator<string>;
+interface RequestWithUser extends Request {
+    user: {
+        userId: string;
+        email: string;
+    };
+}
+export declare class OtpController {
+    private readonly otpService;
+    private readonly jwtService;
+    constructor(otpService: OtpService, jwtService: JwtService);
+    getStatus(req: RequestWithUser): Promise<{
+        emailEnabled: boolean;
+        whatsappEnabled: boolean;
+        totpEnabled: boolean;
+        phone?: undefined;
+        totpSecret?: undefined;
+    } | {
+        phone: string | null;
+        emailEnabled: boolean;
+        whatsappEnabled: boolean;
+        totpEnabled: boolean;
+        totpSecret: string | null;
+    }>;
+    sendEmailOtp(req: RequestWithUser): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    verifyEmailOtp(req: RequestWithUser, body: {
+        code: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    disableEmailOtp(req: RequestWithUser): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    setupTotp(req: RequestWithUser): Promise<{
+        secret: string;
+        qrCode: string;
+    }>;
+    verifyTotp(req: RequestWithUser, body: {
+        code: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    disableTotp(req: RequestWithUser): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    sendWhatsappOtp(req: RequestWithUser, body: {
+        mode?: 'test' | 'live';
+    }): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    verifyWhatsappOtp(req: RequestWithUser, body: {
+        code: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    disableWhatsappOtp(req: RequestWithUser): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    checkWhatsappNumber(body: {
+        phone: string;
+    }): Promise<{
+        success: boolean;
+        isRegistered: boolean;
+        message: string;
+    }>;
+    resendEmailOtp(body: {
+        tempToken: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    resendWhatsappOtp(body: {
+        tempToken: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+}
+export {};