feat: secure backup & encrypted export options

[mendarb]

Summary

• Add POST /export endpoint for encrypted data export (expenses, bills, categories)
• Uses AES-256-GCM encryption with PBKDF2-HMAC-SHA256 key derivation from user-provided password
• Supports JSON and CSV export formats
• Add frontend Export page with format selector, password input, and download button
• Add cryptography dependency to requirements.txt
• Comprehensive backend tests including encryption/decryption round-trip validation

Closes #126

Test plan

• POST /export with valid password and json format returns encrypted payload that decrypts correctly
• POST /export with csv format returns encrypted CSV data
• Passwords shorter than 8 characters are rejected with 400
• Invalid format values are rejected with 400
• Endpoint requires JWT authentication
• Wrong password fails to decrypt (authentication tag mismatch)
• Frontend page renders format selector and password field
• Download triggers a .encrypted.json file save

🤖 Generated with Claude Code