Harden JSON storage (atomic writes + crash-safe loads) + suggestions lightbulb

- storage.py: atomic save_json (temp+fsync+os.replace) and load_json that
  survives missing/corrupt files (moves corrupt aside). Closes #11/#12.
- route all data modules + app.py helpers through storage (closes #31 core);
  fixes mutable DEFAULT_FUNDS/DEFAULT_CARS return (#23).
- gunicorn --workers 1 --threads 4 to remove the write race (#13); strip
  Dockerfile template scaffolding (#40).
- base.html: 💡 suggestions link in the shared nav (shows on every page).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sinking.py

@@ -1,6 +1,8 @@
+import copy
 import json
 import os
 from datetime import date
+from storage import load_json, save_json
 
 DATA_DIR = os.environ.get("DATA_DIR", os.path.join(os.path.dirname(__file__), "data"))
 SINKING_FILE = os.path.join(DATA_DIR, "sinking_funds.json")
@@ -25,17 +27,17 @@ DEFAULT_FUNDS = [
 
 
 def load_funds():
-    if os.path.exists(SINKING_FILE):
-        with open(SINKING_FILE) as f:
-            return json.load(f)
-    # First run — seed with defaults
-    save_funds(DEFAULT_FUNDS)
-    return DEFAULT_FUNDS
+    funds = load_json(SINKING_FILE, None)
+    if funds is None:
+        # First run — seed with a copy of the defaults (never hand out the
+        # module-level list, which callers mutate in place).
+        funds = copy.deepcopy(DEFAULT_FUNDS)
+        save_funds(funds)
+    return funds
 
 
 def save_funds(funds):
-    with open(SINKING_FILE, "w") as f:
-        json.dump(funds, f, indent=2)
+    save_json(SINKING_FILE, funds)
 
 
 def months_until(target_date_str):