feat(finance): Phase 5 — Rules Engine

Add rules engine with CRUD API, condition/action evaluation, and apply-all endpoint.
UI: rule builder form with field/operator/value conditions, tag multi-select, apply button with result stats.

src/app/api/rules/route.ts

@@ -0,0 +1,43 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getCurrentUser } from "@/lib/auth";
+import { queryRaw, prisma } from "@/lib/db";
+
+export async function GET(req: NextRequest) {
+  const user = await getCurrentUser(req);
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
+
+  const rows = await queryRaw<{
+    id: number;
+    name: string;
+    conditions: unknown;
+    actions: unknown;
+    enabled: boolean;
+    priority: number;
+    created_at: string;
+  }>(
+    `SELECT id, name, conditions, actions, enabled, priority, created_at
+     FROM rules WHERE owner_id = $1 ORDER BY priority DESC, id ASC`,
+    [user.id]
+  );
+  return NextResponse.json(rows);
+}
+
+export async function POST(req: NextRequest) {
+  const user = await getCurrentUser(req);
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
+
+  const { name, conditions, actions, enabled = true, priority = 0 } = await req.json();
+  if (!name) return NextResponse.json({ error: "name required" }, { status: 400 });
+
+  const rule = await prisma.rules.create({
+    data: {
+      owner_id: user.id,
+      name,
+      conditions: conditions ?? [],
+      actions: actions ?? {},
+      enabled,
+      priority,
+    },
+  });
+  return NextResponse.json(rule, { status: 201 });
+}