feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/internal/config/config.go

@@ -31,7 +31,6 @@ type S3 struct {
 }
 
 type Auth struct {
-	JWTSecret  string
 	AccessTTL  time.Duration
 	RefreshTTL time.Duration
 }
@@ -154,7 +153,6 @@ func Load() (*Config, error) {
 			SQLitePath: getEnv("SQLITE_PATH", "./galo.db"),
 		},
 		Auth: Auth{
-			JWTSecret:  getEnv("JWT_SECRET", ""),
 			AccessTTL:  accessTTL,
 			RefreshTTL: refreshTTL,
 		},
@@ -173,10 +171,6 @@ func Load() (*Config, error) {
 		},
 	}
 
-	if cfg.Auth.JWTSecret == "" {
-		return nil, fmt.Errorf("JWT_SECRET is required")
-	}
-
 	switch cfg.Database.Backend {
 	case "postgres":
 		if cfg.Postgres.Password == "" {