feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/internal/app/app.go

@@ -50,8 +50,7 @@ type Server struct {
 
 // New wires the domain services over the selected metadata repositories. ping
 // reports the health of the metadata backend so health stays backend-agnostic.
-func New(cfg *config.Config, repos store.Repos, ping func(ctx context.Context) error, st storage.Backend, hub *sse.Hub) *Server {
-	tm := auth.NewTokenManager(cfg.Auth.JWTSecret, cfg.Auth.AccessTTL, cfg.Auth.RefreshTTL)
+func New(cfg *config.Config, repos store.Repos, ping func(ctx context.Context) error, tm *auth.TokenManager, st storage.Backend, hub *sse.Hub) *Server {
 	authSvc := auth.NewService(repos.Auth, tm)
 
 	notifSvc := notifications.NewService(repos.Notifications, hub)

backend/internal/app/objects_test.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
+	"shared-album/internal/auth"
 	"shared-album/internal/config"
 	"shared-album/internal/sse"
 	"shared-album/internal/storage"
@@ -30,7 +31,8 @@ func newTestServerWithFS(t *testing.T) (*storage.FS, *gin.Engine) {
 		t.Fatalf("new fs: %v", err)
 	}
 	noop := func(context.Context) error { return nil }
-	srv := New(&config.Config{}, store.Repos{}, noop, fs, sse.NewHub(1))
+	tm := auth.NewTokenManager("test-secret", 15*time.Minute, time.Hour)
+	srv := New(&config.Config{}, store.Repos{}, noop, tm, fs, sse.NewHub(1))
 	return fs, srv.Router()
 }
 

backend/internal/app/share_flow_test.go

@@ -71,7 +71,8 @@ func runShareFlow(t *testing.T, backend storage.Backend, verify func(t *testing.
 	gin.SetMode(gin.TestMode)
 
 	hub := sse.NewHub(1)
-	srv := New(&config.Config{}, store.NewPostgres(pool), pool.Ping, backend, hub)
+	tm := auth.NewTokenManager("test-secret", 15*time.Minute, time.Hour)
+	srv := New(&config.Config{}, store.NewPostgres(pool), pool.Ping, tm, backend, hub)
 	router := srv.Router()
 
 	authStore := auth.NewStore(pool)