feat: remove OTP gate from transactions, fix categories auth, add implementation plan

- Remove OtpGateGuard from transactions controller (OTP verified at login)
- Fix categories controller to use authenticated user instead of TEMP_USER_ID
- Add comprehensive implementation plan document
- Update .env.example with WEB_APP_URL
- Prepare for admin dashboard development

apps/web/src/components/dialogs/TransactionDialog.tsx

@@ -89,7 +89,7 @@ export function TransactionDialog({ open, onOpenChange, transaction, onSuccess }
       const response = await axios.get(`${API}/categories`)
       const categories = response.data
       
-      const options: Option[] = categories.map((cat: any) => ({
+      const options: Option[] = categories.map((cat: { name: string }) => ({
         label: cat.name,
         value: cat.name
       }))
@@ -147,9 +147,10 @@ export function TransactionDialog({ open, onOpenChange, transaction, onSuccess }
         for (const category of categories) {
           try {
             await axios.post(`${API}/categories`, { name: category })
-          } catch (error: any) {
+          } catch (error) {
             // Ignore if category already exists (409 conflict)
-            if (error.response?.status !== 409) {
+            const err = error as { response?: { status?: number } }
+            if (err.response?.status !== 409) {
               console.error('Failed to create category:', error)
             }
           }