feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/cmd/reconcile/main.go

@@ -18,6 +18,7 @@ import (
 	"shared-album/internal/config"
 	"shared-album/internal/db"
 	"shared-album/internal/reconcile"
+	"shared-album/internal/settings"
 	"shared-album/internal/storage"
 	"shared-album/internal/store"
 )
@@ -50,7 +51,13 @@ func main() {
 	}
 	defer closer()
 
-	blob, err := storage.Open(ctx, cfg)
+	secret, err := repos.Settings.Ensure(ctx, settings.JWTSecretKey, settings.GenerateSecret)
+	if err != nil {
+		slog.Error("secret init failed", "error", err)
+		os.Exit(1)
+	}
+
+	blob, err := storage.Open(ctx, cfg, secret)
 	if err != nil {
 		slog.Error("storage init failed", "error", err)
 		os.Exit(1)