feat: idle cash alert and category hierarchy (subcategories)

Two of the four ideas picked from the Maybe/Sure feature audit:

- Idle cash: a 5th proactive alert flags a depository account (checking/
  savings/cash) sitting at or above a configurable balance with no
  transaction touching it for a configurable number of days.
- Category hierarchy: categories can now have one level of subcategories
  (Groceries -> Alcohol). Dashboard/report aggregations roll a
  subcategory's spending into its parent's slice.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/models/category.py

@@ -1,5 +1,5 @@
 """A spending/income category, colored so it maps 1:1 to a dashboard chart slot."""
-from sqlalchemy import Boolean, Enum, Integer, String
+from sqlalchemy import Boolean, Enum, ForeignKey, Integer, String
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from app.db.base import Base
@@ -22,5 +22,12 @@ class Category(Base):
     # Fixed slot ordering keeps the donut chart's category order stable across renders.
     sort_order: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
     is_default: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+    # Self-referential, one level deep only (routes/categories.py rejects a
+    # parent that itself has a parent) — a subcategory ("Alcohol" under
+    # "Groceries"). SET NULL so deleting a parent turns its children back
+    # into top-level categories instead of cascading the delete.
+    parent_id: Mapped[int | None] = mapped_column(ForeignKey("categories.id", ondelete="SET NULL"), nullable=True)
 
     transactions: Mapped[list["Transaction"]] = relationship(back_populates="category")
+    parent: Mapped["Category | None"] = relationship(remote_side=[id], back_populates="children")
+    children: Mapped[list["Category"]] = relationship(back_populates="parent")

backend/app/models/settings.py

@@ -2,7 +2,9 @@
 single-row table (id is always 1). Primary display currency (see UPDATES.md
 for why this doesn't do currency conversion) and the proactive-alert
 thresholds consumed by services/insights_service.py."""
-from sqlalchemy import Integer, String
+from decimal import Decimal
+
+from sqlalchemy import Integer, Numeric, String
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.db.base import Base
@@ -21,3 +23,9 @@ class AppSettings(Base):
     # tiers before insights_service.py raises risky_allocation_exceeded —
     # the classic "80% at zero risk, 20% at most exposed" rule.
     risky_allocation_threshold_percent: Mapped[int] = mapped_column(Integer, nullable=False, default=20)
+    # A depository account (checking/savings/cash) sitting at or above this
+    # balance with no transaction touching it in idle_cash_threshold_days
+    # raises insights_service.py's idle_cash alert — money that isn't
+    # working. In the app's display currency (see `currency` above).
+    idle_cash_threshold_amount: Mapped[Decimal] = mapped_column(Numeric(14, 2), nullable=False, default=Decimal("1000"))
+    idle_cash_threshold_days: Mapped[int] = mapped_column(Integer, nullable=False, default=60)