test: real backend pytest + E2E Playwright suites, both isolated from prod data

backend/tests/: 33 pytest tests against a real Postgres database
(aurum_test, created/migrated/dropped per run) exercised through the actual
HTTP API — not sqlite, not mocks, and the real `aurum` database is never
opened (app lifespan is skipped, get_session is overridden per test).
Covers transaction category-kind validation, year/month/date-range
filtering and pagination, dashboard summary arithmetic, budget status, cash
flow, and the /transactions/years picker.

e2e/: 6 Playwright specs driving a real browser against a fully separate
throwaway docker-compose stack (run.sh: separate project name, database,
port, and volume, torn down with `down -v` on exit) — regression coverage
for the Recent Transactions month bug, the Card grid-overflow bug, the
frozen-year bug, the Net Worth default range, and the Dashboard->
Transactions deep link, all fixed earlier this session.

Also synced the backend's APP_VERSION constant (stale at 0.15.2, embedded
in exported backups) with the frontend version.

backend/tests/README.md

@@ -0,0 +1,33 @@
+# Backend tests
+
+Real integration tests against a real Postgres database — a dedicated
+`aurum_test` database created fresh, migrated, and dropped again on every
+run. They never touch the real `aurum` database or its data: the app's
+`lifespan` startup (which seeds against the real DB) is never triggered, and
+every route's DB dependency is overridden to point at `aurum_test` instead.
+
+## Running
+
+The stack must already be up (`docker compose up -d`). Test dependencies
+aren't baked into the production image, so install them once per container
+lifetime, then run pytest inside the running `backend` container — it's the
+only place with network access to Postgres:
+
+```bash
+docker compose exec backend pip install -r requirements-dev.txt
+docker compose exec backend pytest -v
+```
+
+Re-run just `pytest -v` for subsequent runs; the `pip install` only needs
+repeating after a container restart/rebuild.
+
+## Adding a test
+
+- Use the `client` fixture (an `httpx.AsyncClient` wired to the app) to hit
+  the API the same way the frontend does — prefer this over reaching into
+  services/models directly, so tests keep verifying the actual contract.
+- `account_id` and `categories` fixtures give you the same default
+  account/categories a real fresh install seeds.
+- Every table is truncated and reseeded before each test (see
+  `conftest.py::_clean_database`), so tests don't need to worry about
+  leftover state or guess at IDs from a previous test.