feat(rules): manual-only rules as one-click quick actions on selected transactions

A rule flagged manual_only never runs in the apply-all pass; instead it shows
as a button in the transactions bulk bar and applies its actions to the current
selection (conditions ignored — the selection is the condition). Recorded as a
rule_apply_run, so it reverts from Rules -> Apply History like any other run.

Motivation: tagging Home + splitting 50/50 with Sonu was two bulk actions every
time. Now it is one click, and any other combo can be defined the same way.

Extracts the action-application and snapshot logic from the apply route into
src/lib/rule-actions.ts so both callers share one implementation — splits upsert
rather than delete+reinsert, so settled flags survive.

src/app/api/rules/route.ts

@@ -12,10 +12,11 @@ export async function GET(req: NextRequest) {
     conditions: unknown;
     actions: unknown;
     enabled: boolean;
+    manual_only: boolean;
     priority: number;
     created_at: string;
   }>(
-    `SELECT id, name, conditions, actions, enabled, priority, created_at
+    `SELECT id, name, conditions, actions, enabled, manual_only, priority, created_at
      FROM rules WHERE owner_id = $1 ORDER BY priority DESC, id ASC`,
     [user.id]
   );
@@ -26,7 +27,7 @@ export async function POST(req: NextRequest) {
   const user = await getCurrentUser(req);
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
 
-  const { name, conditions, actions, enabled = true, priority = 0 } = await req.json();
+  const { name, conditions, actions, enabled = true, manual_only = false, priority = 0 } = await req.json();
   if (!name) return NextResponse.json({ error: "name required" }, { status: 400 });
 
   const rule = await prisma.rules.create({
@@ -36,6 +37,7 @@ export async function POST(req: NextRequest) {
       conditions: conditions ?? [],
       actions: actions ?? {},
       enabled,
+      manual_only,
       priority,
     },
   });