feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

.env.example

@@ -24,13 +24,13 @@ S3_USE_PATH_STYLE=true
 STORAGE_BACKEND=fs
 # Root directory for object blobs (STORAGE_BACKEND=fs)
 FS_ROOT=./data
-# Signs object URLs; falls back to JWT_SECRET when empty
+# Signs object URLs; falls back to the metadata-layer secret when empty
 URL_SECRET=
 # Lifetime of signed object URLs
 OBJECT_URL_TTL=1h
 
-# Auth
-JWT_SECRET=change_me_long_random
+# Auth. The token signing secret is generated on first start and stored in the
+# metadata layer (app_settings); it is not configured here.
 JWT_ACCESS_TTL=15m
 JWT_REFRESH_TTL=720h