feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/internal/app/share_flow_test.go

@@ -71,7 +71,8 @@ func runShareFlow(t *testing.T, backend storage.Backend, verify func(t *testing.
 	gin.SetMode(gin.TestMode)
 
 	hub := sse.NewHub(1)
-	srv := New(&config.Config{}, store.NewPostgres(pool), pool.Ping, backend, hub)
+	tm := auth.NewTokenManager("test-secret", 15*time.Minute, time.Hour)
+	srv := New(&config.Config{}, store.NewPostgres(pool), pool.Ping, tm, backend, hub)
 	router := srv.Router()
 
 	authStore := auth.NewStore(pool)