feat: add free-form tags on transactions

Third of the four ideas picked from the Maybe/Sure feature audit. Tags are
orthogonal to categories (category = what kind of spend, tag = which
event/project) — many-to-many, created inline while typing in the
transaction form, filterable from the Transactions page.

Also adds tests/test_backup.py, the first test coverage the backup
export/import path has ever had, and fixes a MissingGreenlet bug it
surfaced in restore_backup's tag-wiring.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/test_backup.py

@@ -0,0 +1,64 @@
+"""Full-database backup export/import (services/backup_service.py) — only
+the parts this change touched: subcategories (self-referential parent_id)
+and tags (many-to-many) surviving a round trip.
+"""
+from httpx import AsyncClient
+
+from tests.helpers import txn_payload as _txn
+
+
+async def test_backup_roundtrip_preserves_subcategories_and_tags(client: AsyncClient, account_id, categories):
+    parent = await client.post("/categories", json={"name": "Custom Parent", "kind": "expense", "color": "#e34948"})
+    parent_id = parent.json()["id"]
+    child = await client.post(
+        "/categories", json={"name": "Custom Child", "kind": "expense", "color": "#e34948", "parent_id": parent_id}
+    )
+    child_id = child.json()["id"]
+
+    tag = (await client.post("/tags", json={"name": "Roundtrip"})).json()["id"]
+    created = await client.post("/transactions", json=_txn(account_id, category_id=child_id, tag_ids=[tag]))
+    txn_id = created.json()["id"]
+
+    export_resp = await client.get("/backup/export")
+    assert export_resp.status_code == 200
+    payload = export_resp.json()
+
+    import_resp = await client.post("/backup/import", json=payload)
+    assert import_resp.status_code == 200, import_resp.text
+
+    refetched_categories = {c["id"]: c for c in (await client.get("/categories")).json()}
+    assert refetched_categories[child_id]["parent_id"] == parent_id
+
+    refetched_txn = next(t for t in (await client.get("/transactions")).json()["items"] if t["id"] == txn_id)
+    assert [t["id"] for t in refetched_txn["tags"]] == [tag]
+
+
+async def test_backup_import_rejects_transaction_with_unknown_tag_id(client: AsyncClient, account_id, categories):
+    export_resp = await client.get("/backup/export")
+    payload = export_resp.json()
+
+    created = await client.post(
+        "/transactions", json=_txn(account_id, category_id=categories["Groceries"]["id"], date="2026-01-01")
+    )
+    payload["transactions"] = (await client.get("/transactions")).json()["items"]
+    # Reshape to the backup wire format (flat FKs, not nested account/category
+    # objects) and inject a tag_id that doesn't exist in payload["tags"].
+    payload["transactions"] = [
+        {
+            "id": t["id"],
+            "account_id": t["account_id"],
+            "category_id": t["category_id"],
+            "transfer_account_id": t["transfer_account_id"],
+            "type": t["type"],
+            "amount": t["amount"],
+            "description": t["description"],
+            "merchant": t["merchant"],
+            "notes": t["notes"],
+            "date": t["date"],
+            "tag_ids": [999999] if t["id"] == created.json()["id"] else [],
+        }
+        for t in payload["transactions"]
+    ]
+
+    resp = await client.post("/backup/import", json=payload)
+    assert resp.status_code == 400

backend/tests/test_tags.py

@@ -0,0 +1,80 @@
+"""Tags: CRUD, case-insensitive dedup on create, and their use on
+transactions (create/update with tag_ids, filtering by tag_id).
+"""
+from httpx import AsyncClient
+
+from tests.helpers import txn_payload as _txn
+
+
+async def test_create_tag(client: AsyncClient):
+    resp = await client.post("/tags", json={"name": "Georgia Trip"})
+    assert resp.status_code == 201
+    assert resp.json()["name"] == "Georgia Trip"
+
+
+async def test_create_tag_dedups_case_insensitively(client: AsyncClient):
+    first = await client.post("/tags", json={"name": "Tax Deductible"})
+    second = await client.post("/tags", json={"name": "tax deductible"})
+
+    assert first.json()["id"] == second.json()["id"]
+    assert len((await client.get("/tags")).json()) == 1
+
+
+async def test_delete_tag(client: AsyncClient):
+    created = await client.post("/tags", json={"name": "Temp"})
+    resp = await client.delete(f"/tags/{created.json()['id']}")
+    assert resp.status_code == 204
+    assert (await client.get("/tags")).json() == []
+
+
+async def test_create_transaction_with_tags(client: AsyncClient, account_id, categories):
+    tag = await client.post("/tags", json={"name": "Georgia"})
+    tag_id = tag.json()["id"]
+
+    resp = await client.post(
+        "/transactions",
+        json=_txn(account_id, category_id=categories["Groceries"]["id"], tag_ids=[tag_id]),
+    )
+    assert resp.status_code == 201
+    assert [t["id"] for t in resp.json()["tags"]] == [tag_id]
+
+
+async def test_update_transaction_replaces_tags(client: AsyncClient, account_id, categories):
+    tag_a = (await client.post("/tags", json={"name": "A"})).json()["id"]
+    tag_b = (await client.post("/tags", json={"name": "B"})).json()["id"]
+    created = await client.post(
+        "/transactions", json=_txn(account_id, category_id=categories["Groceries"]["id"], tag_ids=[tag_a])
+    )
+    txn_id = created.json()["id"]
+
+    resp = await client.patch(f"/transactions/{txn_id}", json={"tag_ids": [tag_b]})
+    assert [t["id"] for t in resp.json()["tags"]] == [tag_b]
+
+    # Omitting tag_ids entirely leaves the existing tags untouched.
+    resp = await client.patch(f"/transactions/{txn_id}", json={"description": "renamed"})
+    assert [t["id"] for t in resp.json()["tags"]] == [tag_b]
+
+    # Sending an empty list clears them.
+    resp = await client.patch(f"/transactions/{txn_id}", json={"tag_ids": []})
+    assert resp.json()["tags"] == []
+
+
+async def test_create_transaction_rejects_unknown_tag_id(client: AsyncClient, account_id, categories):
+    resp = await client.post(
+        "/transactions",
+        json=_txn(account_id, category_id=categories["Groceries"]["id"], tag_ids=[999999]),
+    )
+    assert resp.status_code == 400
+
+
+async def test_filter_transactions_by_tag(client: AsyncClient, account_id, categories):
+    tag = (await client.post("/tags", json={"name": "Filtered"})).json()["id"]
+    await client.post(
+        "/transactions", json=_txn(account_id, category_id=categories["Groceries"]["id"], tag_ids=[tag])
+    )
+    await client.post("/transactions", json=_txn(account_id, category_id=categories["Groceries"]["id"]))
+
+    resp = await client.get("/transactions", params={"tag_id": tag})
+    body = resp.json()
+    assert body["total"] == 1
+    assert body["items"][0]["tags"][0]["id"] == tag