[FEAT-93] LeanFin: Indexa Capital portfolio sync (+ stored XSS fix)

[jmunar]

Summary

Two independent pieces of work. The XSS fix is first in the branch and stands
alone — it can be reviewed (or cherry-picked) without the feature.

491fae3 — HTML-escape user-controlled strings (stored XSS)

Pre-existing, not introduced by this feature. LeanFin interpolated account
names, label names and bank-supplied transaction text straight into format!
HTML templates. A name containing markup executed script on five surfaces:

Surface	Context
/leanfin/accounts — manual account name	element body
/leanfin/settings — app_id	value="" attribute
/leanfin — account/label <option> lists	element body
/leanfin/balance-evolution — account <option> list	element body
/leanfin/expenses — label pills	element body

Two traps worth knowing about. The <option> cases look escaped in the served
HTML, but the browser re-parses the entity-decoded text and builds a live
<img>, firing its onerror. And the app_id case needs an attribute-shaped
payload (" autofocus onfocus="…) rather than a tag, so a tag-only probe reads
as clean.

Notes and FormInput already escaped; LeanFin was the only app that didn't.
FormInput's helper (which also escapes single quotes, making it safe in both
quoting styles) is promoted to myapps_core::components::html_escape as the
single shared implementation.

db3da8d — Indexa Capital portfolio sync

Adds Indexa as a third account provider. PSD2 covers payment accounts, not
securities/custody accounts, so Enable Banking cannot see an Indexa account
(depositary: Cecabank) — until now it could only be tracked manually.

• Read-only personal API token, sent as X-AUTH-TOKEN, stored AES-256-GCM
  encrypted alongside the Enable Banking key. It doesn't expire, so linked
  accounts use the 9999-12-31 sentinel and never prompt for re-auth.
• Linking backfills the full valuation history from performance.portfolios[],
  which reaches back to account opening. PSD2 gives 90 days at best.
• The daily cron calls only /portfolio.

Privacy: /users/me and /accounts/{n} embed postal address, email and
national ID document numbers, despite Indexa's docs claiming the API excludes
personal data. Neither is payload-logged, the sync path never calls them, and
the response structs deserialize only what's needed.

Two bugs caught during development, both fixed here:

• Indexa accounts would have charted wrong — get_balance_series sent every
  non-manual type down the bank path, which reconstructs balances by walking
  transactions backwards from a snapshot. Indexa accounts have snapshots and no
  transactions, so that yields nothing.
• Multi-select would have 422'd in the browser. axum's Form uses
  serde_urlencoded, which can't deserialize repeated keys into a Vec, so
  account selection uses acct_{number} checkboxes into a HashMap.

Test plan

• make check — green: fmt, clippy, 400 tests.
• Response structs verified against live API payloads captured from a real
  account.
• Browser-walked with /frontend-walkthrough: the section renders, the link
  route redirects to settings without a token, the token field never echoes a
  stored value, a bogus token produces the error card rather than a 5xx, and a
  traversal-shaped acct_../../etc/passwd POST persists nothing.
• user_controlled_names_are_html_escaped asserts six routes render a stored
  payload escaped. Confirmed to fail when any single escape is reverted.

Not verified: the end-to-end link flow against Indexa with a valid token —
the walkthrough only exercised the bad-token path. Worth doing manually before
merge. Expect a flat 3-day line on the balance chart until trades execute and
history accumulates.

🤖 Generated with Claude Code