feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/internal/repo/contract/postgres_test.go

@@ -17,6 +17,7 @@ import (
 	"shared-album/internal/members"
 	"shared-album/internal/notifications"
 	"shared-album/internal/photos"
+	"shared-album/internal/settings"
 	"shared-album/internal/sharelinks"
 	"shared-album/internal/social"
 )
@@ -70,8 +71,9 @@ func TestPostgresContract(t *testing.T) {
 		Social:        social.NewStore(pool),
 		Notifications: notifications.NewStore(pool),
 		ShareLinks:    sharelinks.NewStore(pool),
+		Settings:      settings.NewStore(pool),
 		Reset: func(ctx context.Context) error {
-			_, err := pool.Exec(ctx, `TRUNCATE users, objects CASCADE`)
+			_, err := pool.Exec(ctx, `TRUNCATE users, objects, app_settings CASCADE`)
 			return err
 		},
 	})