feat: import transactions from a CSV bank statement

Fourth of the four ideas picked from the Maybe/Sure feature audit, and the
last one queued up. A 3-step wizard (account -> column mapping -> preview)
at /transactions/import, parsed entirely client-side (new lib/csv.ts —
delimiter auto-detect, 5 date formats, thousands/decimal-separator-aware
amounts) and submitted through a new all-or-nothing POST /transactions/bulk
endpoint, mirroring backup restore's validate-everything-before-touching-
anything approach.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/api/routes/transactions.py

@@ -11,7 +11,14 @@ from app.models.category import Category
 from app.models.enums import CategoryKind, TransactionType
 from app.models.tag import Tag
 from app.models.transaction import Transaction
-from app.schemas.transaction import TransactionCreate, TransactionPage, TransactionRead, TransactionUpdate
+from app.schemas.transaction import (
+    TransactionBulkCreate,
+    TransactionBulkCreateResult,
+    TransactionCreate,
+    TransactionPage,
+    TransactionRead,
+    TransactionUpdate,
+)
 
 router = APIRouter(prefix="/transactions", tags=["transactions"])
 
@@ -154,6 +161,27 @@ async def create_transaction(payload: TransactionCreate, session: AsyncSession =
     return refreshed.scalar_one()
 
 
+@router.post("/bulk", response_model=TransactionBulkCreateResult, status_code=201)
+async def bulk_create_transactions(
+    payload: TransactionBulkCreate, session: AsyncSession = Depends(get_session)
+) -> TransactionBulkCreateResult:
+    """CSV import lands here — see schemas.TransactionBulkCreate. All rows
+    are validated before any is added, so a bad row 400s the whole request
+    instead of leaving a half-imported statement behind."""
+    for item in payload.items:
+        await _ensure_category_matches_type(session, item.category_id, item.type)
+
+    transactions = []
+    for item in payload.items:
+        transaction = Transaction(**item.model_dump(exclude={"tag_ids"}))
+        transaction.tags = await _resolve_tags(session, item.tag_ids)
+        transactions.append(transaction)
+
+    session.add_all(transactions)
+    await session.commit()
+    return TransactionBulkCreateResult(created=len(transactions))
+
+
 @router.patch("/{transaction_id}", response_model=TransactionRead)
 async def update_transaction(
     transaction_id: int, payload: TransactionUpdate, session: AsyncSession = Depends(get_session)