spending: prefill annual £ from actualbudget trailing 12mo

Adds a thin read-only client for the actualbudget HTTP API
(`fire_planner/actualbudget.py`) and a `GET /spending/annual` endpoint
that returns trailing-N-month spending broken out by category group.

Default exclusions ("Investments and Savings", "Budget Reset") strip
out wealth transfers so the headline number reflects actual
consumption — for Viktor's data, ~£41k/yr instead of the raw £210k
total. Caller can pass `?exclude=...` to override.

Frontend uses the headline `total_gbp` to autofill the Annual spending
input (same pattern as nw_seed from networth), with a small
provenance line below the input showing the window + which groups
were excluded.

Auth: 3 new env vars (ACTUALBUDGET_API_URL/KEY/SYNC_ID) sourced from
Vault `secret/fire-planner` via the existing ExternalSecret —
infra/stacks/fire-planner applied separately. Backend silently keeps
the hardcoded default if the upstream is unreachable.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

fire_planner/app.py

@@ -46,6 +46,7 @@ from fire_planner.api.life_events import router as life_events_router
 from fire_planner.api.networth import router as networth_router
 from fire_planner.api.scenarios import router as scenarios_router
 from fire_planner.api.simulate import router as simulate_router
+from fire_planner.api.spending import router as spending_router
 from fire_planner.db import create_engine_from_env, make_session_factory
 
 log = logging.getLogger(__name__)
@@ -126,6 +127,7 @@ app.include_router(scenarios_router, prefix=_API_PREFIX)
 app.include_router(life_events_router, prefix=_API_PREFIX)
 app.include_router(goals_router, prefix=_API_PREFIX)
 app.include_router(simulate_router, prefix=_API_PREFIX)
+app.include_router(spending_router, prefix=_API_PREFIX)
 
 
 @app.post(