Set a merchant's category on every row from it that no person categorized

Firm-side family relationships only. Select the firm with x-organization-id. Owners, Admins and Staff Admins access all firm families; Staff Members need independent family assignment. Company access does not grant family access. OAuth requires the broad mcp grant, not a narrow banking scope; API keys retain ordinary agent permission scopes. No accounting organizations, portal grants, bank changes, invitations or charges are created. Writes require ordinary firm write entitlement. Cross-firm and inaccessible IDs return 404. Personal accounts never post journals; these operations read delivered bank rows and save household categories, notes and rules. Rows nobody categorized by hand are categorized automatically (rule, then the firm's earlier choice for the merchant, then Plaid, then AI); a person's choice always wins. Rules never hide rows. Recorded as a person's choice and remembered by the firm for this merchant. Requires banking permission.