fix: filter transactions by user_id to prevent data exposure

[memosr]

Problem

The GET /api/transactions endpoint authenticates the user but fetches all transactions with transaction_type = 'USER' — without filtering by the authenticated user's ID.

This means any logged-in user can see every other user's transaction history.

Fix

Added .eq("user_id", user.id) filter to the Supabase query so each user only sees their own transactions.

- .eq("transaction_type", "USER")
+ .eq("transaction_type", "USER")
+ .eq("user_id", user.id)

Impact

• Security: Prevents unauthorized access to other users' transaction data
• Privacy: Each user now only sees their own transaction history
• Risk: Low — additive filter, no breaking changes