createTransaction now stamps createdByUsername from the session. listTransactions
scopes results to the logged-in staff's own transactions, or (for admins) all
transactions with an optional ?staff= filter sourced from real AdminUser
records - the filter is ignored for non-admin sessions so staff cannot view
another account's data by editing the query string. Transaction routes now use
requireLogin instead of basicAuth, which is now unused and deleted.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>