feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/internal/repo/contract/sqlite_test.go

@@ -13,6 +13,7 @@ import (
 	"shared-album/internal/members"
 	"shared-album/internal/notifications"
 	"shared-album/internal/photos"
+	"shared-album/internal/settings"
 	"shared-album/internal/sharelinks"
 	"shared-album/internal/social"
 )
@@ -40,11 +41,12 @@ func TestSQLiteContract(t *testing.T) {
 		Social:        social.NewSQLiteStore(database),
 		Notifications: notifications.NewSQLiteStore(database),
 		ShareLinks:    sharelinks.NewSQLiteStore(database),
+		Settings:      settings.NewSQLiteStore(database),
 		Reset: func(ctx context.Context) error {
 			tables := []string{
 				"variant_jobs", "photo_objects", "objects", "photo_tags", "tags",
 				"refresh_tokens", "share_links", "notifications", "likes", "comments",
-				"invites", "album_members", "photos", "albums", "users",
+				"invites", "album_members", "photos", "albums", "users", "app_settings",
 			}
 			for _, tbl := range tables {
 				if _, err := database.ExecContext(ctx, "DELETE FROM "+tbl); err != nil {