No way to filter expenses by category

GET /expenses always returns every one of the caller's expenses. A user who wants to review just their "Entertainment" spending, or a client building a per-category expense view, has to fetch everything and filter client-side -- wasted transfer and work that grows without bound as a user's expense history grows.

Repo.List(ctx, userID) takes only a user id and always returns every expense owned by that user; there's no way to narrow by category. Handler.List never parses a category_id query parameter at all.

As an authenticated user with expenses in more than one category, GET /expenses?category_id=1.

Expected: only expenses in category 1.

Actual: every expense the caller owns, regardless of category.

This is the exact same lesson as filtering elsewhere in this codebase (and in the bookmark_manager project) -- add the new filter as an optional, additional AND condition in the WHERE clause, parameterized, without breaking the mandatory user_id = $1 ownership scoping that's the actual point of every query in this file. The category filter must be applied in addition to, never instead of, the existing user-scoping -- this is the same file where Ticket 09 lives, so pay close attention to keeping that scoping intact.

Extend Repo.List to accept an optional category id (e.g. categoryID *int64, nil meaning "no filter") and add a conditional AND e.category_id = $N clause, mirroring how bookmark_manager's Store.List conditionally adds clauses. Parse ?category_id= in Handler.List and pass it through.