Enforce optional group PINs on the server

[t0ma5]

Summary

• Optional 6–8 digit group PIN, hashed with PBKDF2 (pinHash is never returned to clients).
• Unlock is an HTTP-only HMAC cookie (PIN_SECRET). tRPC group procedures and CSV/JSON export require it.
• Failed attempts are rate-limited in Postgres (PinAttempt).

Fixes #373 — the PIN is no longer a UI-only check.

Run prisma migrate deploy after merge. Set PIN_SECRET (16+ chars) in production if any group uses a PIN.

Test plan

• Create a group without a PIN; expenses still work.
• Set a PIN on a group, open the URL in a private window; the unlock dialog appears and expenses/export return 401 until the PIN is entered.
• After a correct PIN, the HTTP-only cookie is set and the group loads. Changing/clearing the PIN requires the current PIN.
• Eight failed attempts lock further tries for 15 minutes.