v1.1.2

Added

• MCP server for AI assistants (#14): Streamable HTTP endpoint at /api/v1/mcp with tools to read accounts, categories, transactions, budgets, goals, subscriptions, reports and net worth, and to create/update transactions. Off by default, per user. Enabling is done from Settings > API after an explicit acknowledgement plus password (and 2FA code) re-entry, from a login session only. Needs an API key; each tool enforces the key's scopes. No delete tool.
• GBP currency (#18).
• Drag and drop, multiple receipts at once (#17).
• Scanned PDFs are now OCR'd instead of failing (#16).

Fixed

• API-key scopes were not enforced on the REST API. A key limited to read:accounts could still create transactions, read other resources, or create a new unrestricted API key. Scopes are now checked for every API-key request. Routes with no scope of their own (API keys, webhooks, backup, loans, search, ...) need read:* / write:*, and the Home Assistant endpoints need read:reports. Full-access keys and login sessions are unaffected. If you gave Home Assistant or a script a scoped key, check it holds the scopes above.
• Incomplete English translation (#15).
• The Quick Entry amount no longer shows a hardcoded MX$ prefix.

Full details: CHANGELOG.