feat(finance): Phase 6 — Budget & Analytics

Add monthly budgets per category with spend-vs-budget dashboard and 6-month trend table.
Includes upsert budget API, monthly analytics endpoint, inline budget editing, and route auth fixes.

src/app/api/budgets/[id]/route.ts

@@ -0,0 +1,18 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getCurrentUser } from "@/lib/auth";
+import { queryRaw } from "@/lib/db";
+
+export async function DELETE(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const user = await getCurrentUser(req);
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
+
+  const { id } = await params;
+  const existing = await queryRaw<{ id: number }>(
+    `SELECT id FROM budgets WHERE id = $1 AND owner_id = $2`,
+    [Number(id), user.id]
+  );
+  if (!existing.length) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  await queryRaw(`DELETE FROM budgets WHERE id = $1`, [Number(id)]);
+  return NextResponse.json({ ok: true });
+}

src/app/api/budgets/route.ts

@@ -0,0 +1,46 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getCurrentUser } from "@/lib/auth";
+import { queryRaw } from "@/lib/db";
+
+export async function GET(req: NextRequest) {
+  const user = await getCurrentUser(req);
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
+
+  const { searchParams } = new URL(req.url);
+  const month = searchParams.get("month");
+
+  let monthDate: string;
+  if (month) {
+    monthDate = month.length === 7 ? `${month}-01` : month;
+  } else {
+    const now = new Date();
+    monthDate = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-01`;
+  }
+
+  const rows = await queryRaw<{ id: number; category: string; month: string; amount_limit: number }>(
+    `SELECT id, category, month::text, amount_limit::numeric FROM budgets WHERE owner_id = $1 AND month = $2::date`,
+    [user.id, monthDate]
+  );
+  return NextResponse.json(rows);
+}
+
+export async function POST(req: NextRequest) {
+  const user = await getCurrentUser(req);
+  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
+
+  const { category, month, amount_limit } = await req.json();
+  if (!category || !month || amount_limit === undefined) {
+    return NextResponse.json({ error: "category, month, and amount_limit required" }, { status: 400 });
+  }
+
+  const monthDate = month.length === 7 ? `${month}-01` : month;
+
+  const rows = await queryRaw<{ id: number; category: string; month: string; amount_limit: number }>(
+    `INSERT INTO budgets (owner_id, category, month, amount_limit)
+     VALUES ($1, $2, $3::date, $4)
+     ON CONFLICT (owner_id, category, month) DO UPDATE SET amount_limit = $4, updated_at = NOW()
+     RETURNING id, category, month::text, amount_limit::numeric`,
+    [user.id, category, monthDate, amount_limit]
+  );
+  return NextResponse.json(rows[0], { status: 201 });
+}