feat: idle cash alert and category hierarchy (subcategories)

Two of the four ideas picked from the Maybe/Sure feature audit:

- Idle cash: a 5th proactive alert flags a depository account (checking/
  savings/cash) sitting at or above a configurable balance with no
  transaction touching it for a configurable number of days.
- Category hierarchy: categories can now have one level of subcategories
  (Groceries -> Alcohol). Dashboard/report aggregations roll a
  subcategory's spending into its parent's slice.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/schemas/backup.py

@@ -37,6 +37,9 @@ class CategoryBackup(BaseModel):
     color: str
     sort_order: int
     is_default: bool
+    # Defaulted so a backup exported before subcategories existed still
+    # imports cleanly under the same format version.
+    parent_id: int | None = None
 
 
 class TransactionBackup(BaseModel):
@@ -136,6 +139,10 @@ class AppSettingsBackup(BaseModel):
     # Defaulted so a backup exported before this threshold existed still
     # imports cleanly under the same format version.
     risky_allocation_threshold_percent: int = 20
+    # Defaulted so a backup exported before idle-cash thresholds existed
+    # still imports cleanly under the same format version.
+    idle_cash_threshold_amount: Decimal = Decimal("1000")
+    idle_cash_threshold_days: int = 60
 
 
 class BackupPayload(BaseModel):

backend/app/schemas/category.py

@@ -9,6 +9,9 @@ class CategoryBase(BaseModel):
     icon: str | None = None
     color: str = Field(pattern=r"^#[0-9a-fA-F]{6}$")
     sort_order: int = 0
+    # Subcategory parent, one level deep only — routes/categories.py rejects
+    # a parent that itself already has a parent.
+    parent_id: int | None = None
 
 
 class CategoryCreate(CategoryBase):
@@ -20,6 +23,10 @@ class CategoryUpdate(BaseModel):
     icon: str | None = None
     color: str | None = Field(default=None, pattern=r"^#[0-9a-fA-F]{6}$")
     sort_order: int | None = None
+    # The route uses exclude_unset=True, so sending parent_id explicitly as
+    # null (as opposed to omitting the field) is what turns a subcategory
+    # back into a top-level category.
+    parent_id: int | None = None
 
 
 class CategoryRead(CategoryBase):

backend/app/schemas/settings.py

@@ -1,3 +1,5 @@
+from decimal import Decimal
+
 from pydantic import BaseModel, Field
 
 
@@ -6,6 +8,8 @@ class AppSettingsRead(BaseModel):
     negative_cash_flow_threshold_months: int
     net_worth_decline_threshold_months: int
     risky_allocation_threshold_percent: int
+    idle_cash_threshold_amount: Decimal
+    idle_cash_threshold_days: int
 
 
 class AppSettingsUpdate(BaseModel):
@@ -24,3 +28,7 @@ class AppSettingsUpdate(BaseModel):
     # Max % of capital allowed in medium/high risk tiers (the 80/20 rule's
     # "20% at most exposed" half) before risky_allocation_exceeded fires.
     risky_allocation_threshold_percent: int | None = Field(default=None, ge=1, le=100)
+    # Balance (in the app's display currency) and days of no activity a
+    # depository account needs to hit before idle_cash fires.
+    idle_cash_threshold_amount: Decimal | None = Field(default=None, ge=0, max_digits=14, decimal_places=2)
+    idle_cash_threshold_days: int | None = Field(default=None, ge=1, le=365)