fix: Use try-finally to ensure temp backend cleanup

Refactor YNAB budget selection to use try-finally block, guaranteeing
temp_backend.clear_auth() is called even if an unexpected exception
occurs between login and the exception handler.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: Tom Maloney

moneyflow/app.py

@@ -623,16 +623,12 @@ async def _handle_add_new_account(self, account_manager: AccountManager):
 
                         if budget_id is None:
                             # User cancelled budget selection - clean up
-                            temp_backend.clear_auth()
                             creds.clear()
                             account_manager.delete_account(account.id)
                             return None
                     elif len(budgets) == 1:
                         budget_id = budgets[0]["id"]
 
-                    # Clear the temporary backend
-                    temp_backend.clear_auth()
-
                     # Update the account with the selected budget_id
                     if budget_id:
                         account.budget_id = budget_id
@@ -648,10 +644,12 @@ async def _handle_add_new_account(self, account_manager: AccountManager):
                     logger = get_logger(__name__)
                     logger.error("Failed to fetch YNAB budgets during account setup")
                     # Clean up credentials and account if budget selection fails
-                    temp_backend.clear_auth()
                     creds.clear()
                     account_manager.delete_account(account.id)
                     return None
+                finally:
+                    # Always clear temporary backend auth to minimize credential exposure
+                    temp_backend.clear_auth()
         else:
             # Backend doesn't need credentials (Amazon, Demo)
             creds = {"backend_type": backend_type}