feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/cmd/backfill-exif/main.go

@@ -9,8 +9,9 @@ import (
 
 	"shared-album/internal/config"
 	"shared-album/internal/db"
-	"shared-album/internal/photos"
+	"shared-album/internal/settings"
 	"shared-album/internal/storage"
+	"shared-album/internal/store"
 )
 
 func main() {
@@ -35,14 +36,20 @@ func main() {
 	}
 	defer pool.Close()
 
-	store, err := storage.Open(ctx, cfg)
+	repos := store.NewPostgres(pool)
+	secret, err := repos.Settings.Ensure(ctx, settings.JWTSecretKey, settings.GenerateSecret)
+	if err != nil {
+		slog.Error("secret init failed", "error", err)
+		os.Exit(1)
+	}
+
+	blob, err := storage.Open(ctx, cfg, secret)
 	if err != nil {
 		slog.Error("storage init failed", "error", err)
 		os.Exit(1)
 	}
 
-	photoStore := photos.NewStore(pool)
-	updated, err := photoStore.BackfillEXIF(ctx, store.Get)
+	updated, err := repos.Photos.BackfillEXIF(ctx, blob.Get)
 	if err != nil {
 		slog.Error("backfill failed", "error", err)
 		os.Exit(1)