feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/internal/app/objects_test.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
+	"shared-album/internal/auth"
 	"shared-album/internal/config"
 	"shared-album/internal/sse"
 	"shared-album/internal/storage"
@@ -30,7 +31,8 @@ func newTestServerWithFS(t *testing.T) (*storage.FS, *gin.Engine) {
 		t.Fatalf("new fs: %v", err)
 	}
 	noop := func(context.Context) error { return nil }
-	srv := New(&config.Config{}, store.Repos{}, noop, fs, sse.NewHub(1))
+	tm := auth.NewTokenManager("test-secret", 15*time.Minute, time.Hour)
+	srv := New(&config.Config{}, store.Repos{}, noop, tm, fs, sse.NewHub(1))
 	return fs, srv.Router()
 }