feat: add privacy controls, minute history and ZIP backups

apps/api/prisma/schema.prisma

@@ -10,6 +10,8 @@ model User {
   username String @unique @db.VarChar(64)
   passwordHash String @db.VarChar(255)
   baseCurrency String @default("CNY") @db.Char(3)
+  showSidebar Boolean @default(true)
+  idleMinutes Int @default(30)
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
   positions Position[]
@@ -21,6 +23,10 @@ model Session {
   userId String @db.Char(36)
   user User @relation(fields:[userId],references:[id],onDelete:Cascade)
   expiresAt DateTime
+  lastActivity DateTime @default(now())
+  revealUntil DateTime?
+  backupDigest String? @db.Char(64)
+  backupExpiresAt DateTime?
   @@index([userId])
 }
 model Position {
@@ -35,6 +41,7 @@ model Position {
   currency String @db.Char(3)
   notes String @db.Text
   archived Boolean @default(false)
+  hidden Boolean @default(false)
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
   revisions Revision[]
@@ -49,7 +56,7 @@ model Revision {
   positionId String @db.Char(36)
   position Position @relation(fields:[positionId],references:[id],onDelete:Cascade)
   amount Decimal @db.Decimal(24,8)
-  effectiveDate DateTime @db.Date
+  effectiveDate DateTime @db.DateTime(3)
   notes String @db.Text
   reason String @db.VarChar(20)
   createdAt DateTime @default(now())