fix(security): Phase 0 — close IDOR, source leak, broken update, filter injection

[niyazmft]

Phase 0 — Security & Data Integrity

Closes the four P0 findings from the 4-agent senior-engineer code audit (see reports/code-audit.md).

Fixes

• P0-1 — Subscription IDOR (Critical): updateSubscription/deleteSubscription now fetch the record and verify user_id === req.user.uid before mutating (403 on mismatch). Previously any authenticated user could modify/delete any other user's subscription by ID. Mirrors the existing savingsGoalController ownership pattern.
• P0-2 — Frontend source served publicly (Critical): removed express.static(frontend/src) from app.js. The entire Vue source tree (components, services, stores) was being served verbatim. Only dist/ is now served.
• P0-3 — Transaction update drops payload (High): updateTransaction was calling updateRecord(tableId, id, updatedData) but the service signature is updateRecord(tableId, data) — the validated fields were silently dropped and the PATCH body was the raw id string. Now sends { Id: id, ...updatedData }.
• P0-4 — Filter injection + DoS (High): startDate/endDate are now validated with validateAndFormatDate before interpolation into NocoDB filter strings (transactionService + all 3 report endpoints). duration in the cash-flow forecast is clamped to 1–365 to prevent the unbounded per-day simulation CPU DoS.

Tests added (90 passing, +0 failures)

• subscriptionController.test.js — IDOR: cross-user update/delete → 403, service not called
• transactionController.test.js — update sends object payload (not raw id), cross-user → 403
• transactionService.test.js — filter-injection guard, invalid endDate → 400, validated dates in where clause
• cashFlowController.test.js — duration default 30, clamp to 365, clamp negative to 1

Verification

• pnpm test — 90 passing
• eslint backend/**/*.js — clean
• app.js loads without error

Notes

• Read-only audit; no unrelated changes.
• The docs commit (docs: document intentional design choices) is on main separately.