docs(reference): refresh engineering manual for v0.40.0 / TS+React 19
Reflects the current codebase after the TypeScript + React 19 migration
and the v0.28.1 -> v0.40.0 feature work (subscriptions, spending,
snowball plans, SimpleFIN, WebAuthn, TOTP, push notifications, calendar
feed, category groups, money-cents migration in progress, encrypted
secrets, Node 18 -> 22, Forgejo CI, branded Dollars/Cents types).
- Bump version 0.28.1 -> 0.40.0; add Notable-changes summary.
- Reorder API reference (5.1-5.22) to cover all 26 routes incl.
TOTP, WebAuthn, OIDC, spending, subscriptions, snowball plans,
health, calendar feed, update-status.
- Add services for 2FA, encryption, login fingerprint, bank sync,
OFX import, merchant rules, merchant-store matches, advisory
filters, drift, APR, payment-accounting, calendar feed.
- Schema: add 12 new tables, document migrations v0.65 -> v1.06,
expand ROLLBACK_SQL_MAP through v1.04 (v1.05/v1.06 not yet
rollbackable).
- New section on client/lib/ (branded money, TrackerRow, Schedule,
cashflowUtils, etc.).
- New auth/security flows: TOTP challenge, WebAuthn ceremony,
session token hashing, encrypted-at-rest secrets, login
fingerprint + location, bank-sync safety.
- Add Vite/TS/ESLint config sections; update Dockerfile to
node:22-alpine; add Forgejo CI workflow note.
- Expand env vars with TRUST_PROXY, WEBAUTHN_*, ENCRYPTION_KEY,
BIND_HOST, API_PORT, DATA_IMPORT_ENABLED.
6a2db3780f