web: categories screen with inline create

[rghvgrv]

Parent

#196 — PRD: Angular web client for SubVora (parity minus reminders)

What to build

The categories screen, read plus create: the user's categories alongside the system defaults, with an inline field to add one. System defaults are badged and not editable — the API answers 404 for attempts to change them, so the UI must not offer the action in the first place.

Implementation Steps

1. API service — core/api/categories-api.service.ts with getAll() and create(name) (409 on a duplicate name).
2. Store — features/categories/categories.store.ts: items signal, load(), create(name) appending the created category; failures via the error mapper.
3. Screen — features/categories/categories.component.ts: a list showing each name with a "System" badge for isSystemDefault, and an inline add field (required, ≤100 characters).
4. Duplicate handling — a 409 shows "A category with this name already exists." against the input rather than as a transient snackbar, so the user can correct it in place.
5. Route — lazily-loaded /categories behind authGuard, linked from the shell nav.
6. Spec — categories.store.spec.ts: create appends on success; a 409 surfaces the duplicate message and appends nothing; a load failure surfaces the mapped message.

Agent Routing

agent_routing:
  complexity_hint: easy
  required_capability: balanced
  parallel_safe: true
  cost_preference: low
  speed_preference: balanced
  ownership_scope:
    - src/SubVora.Web/src/app/core/api/categories-api.service.ts
    - src/SubVora.Web/src/app/features/categories/**
    - src/SubVora.Web/src/app/app.routes.ts
  verification:
    - cd src/SubVora.Web && npx ng test --no-watch

Technical Context Snapshot

Current stack in scope

• UI: Angular (20+) standalone components with signals and built-in control flow, Angular Material (Material 3) as the only component library, SCSS. Static SPA — no SSR, no service worker.
• State: signal-backed injectable stores, one per domain area, mirroring the MAUI ViewModel split in src/SubVora.Mobile/ViewModels one-to-one. No NgRx.
• API access: hand-written models plus one service per API controller under src/SubVora.Web/src/app/core/api. Enums travel as JSON strings (JsonStringEnumConverter in Program.cs), so TypeScript string-literal unions are exact.
• Backend consumed unchanged: ASP.NET Core net10.0, /api/v1/, JWT bearer in the Authorization header, tokens in JSON bodies (no cookies).
• Tests: Angular CLI unit-test builder (Vitest runner; Karma is deprecated) with HttpTestingController. Stores, interceptors, mappers and utils only — no component-DOM or browser automation.

Dependencies in scope

• Reuse: @angular/*, @angular/material, rxjs, and the utilities already added under src/SubVora.Web/src/app/core. No chart library, no date library, no HTTP wrapper library.
• New dependency additions allowed for this slice: no. If a dependency looks unavoidable, stop and raise it on the issue rather than adding it.

Architecture alignment

• Preserve the repo's load-bearing rules (CLAUDE.md): burn-rate maths is server-side and counts cycles, never days; currency conversion is a read-time projection and stored amounts are never overwritten; nothing advances next_billing_date on a timer; provider matching stays one SQL query; the mobile SQLite cache stays a read-only mirror.
• There is deliberately no shared DTO project. Web models mirror the API's JSON contract by convention — a contract change means editing both sides.
• create-git-issue provides routing hints only and assigns no concrete agent or model.
• run-with-it remains the final runtime routing authority.

Integration touchpoints

• Consumes GET and POST /api/v1/categories; the name has a unique index per user, surfaced as 409.
• System default categories (Entertainment, Productivity, Fitness, Utilities, Finance, Food, Travel, Other) are shared and not user-editable.
• Mirrors CreateCategoryRequestValidator: name required, ≤100 characters; the server trims it.

Acceptance criteria

• Categories load with system defaults clearly badged and no edit affordances on them.
• Adding a category appends it to the list; a duplicate name shows the server message against the input.
• The screen is reachable from the shell nav and guarded.

Blocked by

• web: auth interceptor with proactive and single-flight token refresh #205 (slice 9)