Consistency sweep: enum members, keyword status codes, SimpleCookie

analytics.py filters by TransactionType.COMPRA instead of the string
literal; budget.py uses keyword HTTPException args; the agent
middleware parses cookies with stdlib SimpleCookie instead of a regex
(ARCH-10); auth.py's lazy imports are hoisted — there was never an
actual auth/db cycle (ARCH-20); transactions.py hoists or_/and_.
Verified: dev container boots, agent auth paths return 401 for
missing/garbage cookies.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/api/v1/endpoints/transactions.py

@@ -3,6 +3,7 @@ from typing import Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Query
 from pydantic import BaseModel
+from sqlalchemy import and_, or_
 from sqlmodel import Session, col, func, select
 
 from app.auth import get_current_user
@@ -73,7 +74,6 @@ def list_transactions(
         prev_y, prev_m = get_previous_cycle(cycle_year, cycle_month)
         prev_start, prev_end = get_cycle_range(prev_y, prev_m)
         # Normal transactions in this cycle (not deferred) + deferred from previous cycle
-        from sqlalchemy import or_, and_
         query = query.where(
             or_(
                 and_(