fix: filter GET /api/transactions by authenticated user_id - #61

Summary

• Add .eq("user_id", user.id) to the GET /api/transactions Supabase query so authenticated users only receive their own rows
• Closes the data-exposure gap where any logged-in user could list all transaction_type = 'USER' records

Related: open PR #31 covers overlapping user_id filtering work; this PR is a focused fix on the list endpoint against current upstream/master.

Test plan

• As user A, create/list transactions and confirm only A's rows are returned
• As user B, call GET /api/transactions and confirm A's transactions are not returned
• Unauthenticated request still returns 401