feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/internal/settings/generate.go

@@ -0,0 +1,15 @@
+package settings
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+)
+
+// GenerateSecret returns a new random secret suitable for HMAC signing.
+func GenerateSecret() (string, error) {
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(buf), nil
+}

backend/internal/settings/settings.go

@@ -0,0 +1,20 @@
+// Package settings persists application-level key/value settings in the
+// metadata layer. The main use is the token signing secret, generated on first
+// use and reused afterwards.
+package settings
+
+import "context"
+
+// JWTSecretKey is the settings key holding the token signing secret.
+const JWTSecretKey = "jwt_secret"
+
+// Repository reads and writes application settings.
+type Repository interface {
+	// Get returns the value for key and whether it exists.
+	Get(ctx context.Context, key string) (string, bool, error)
+	// Set stores or replaces the value for key.
+	Set(ctx context.Context, key, value string) error
+	// Ensure returns the existing value for key, or generates and stores one
+	// using generate when absent. Concurrent first use yields one value.
+	Ensure(ctx context.Context, key string, generate func() (string, error)) (string, error)
+}

backend/internal/settings/sqlite_store.go

@@ -0,0 +1,63 @@
+package settings
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"time"
+
+	"shared-album/internal/sqliteutil"
+)
+
+// SQLiteStore is the SQLite implementation of Repository.
+type SQLiteStore struct {
+	db *sql.DB
+}
+
+func NewSQLiteStore(db *sql.DB) *SQLiteStore { return &SQLiteStore{db: db} }
+
+func (s *SQLiteStore) Get(ctx context.Context, key string) (string, bool, error) {
+	var v string
+	err := s.db.QueryRowContext(ctx, `SELECT value FROM app_settings WHERE key = $1`, key).Scan(&v)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return "", false, nil
+		}
+		return "", false, err
+	}
+	return v, true, nil
+}
+
+func (s *SQLiteStore) Set(ctx context.Context, key, value string) error {
+	_, err := s.db.ExecContext(ctx,
+		`INSERT INTO app_settings (key, value) VALUES ($1, $2)
+		 ON CONFLICT (key) DO UPDATE SET value = excluded.value, updated_at = $3`,
+		key, value, sqliteutil.FormatTime(time.Now()))
+	return err
+}
+
+func (s *SQLiteStore) Ensure(ctx context.Context, key string, generate func() (string, error)) (string, error) {
+	if v, ok, err := s.Get(ctx, key); err != nil {
+		return "", err
+	} else if ok {
+		return v, nil
+	}
+	v, err := generate()
+	if err != nil {
+		return "", err
+	}
+	if _, err := s.db.ExecContext(ctx,
+		`INSERT INTO app_settings (key, value) VALUES ($1, $2) ON CONFLICT (key) DO NOTHING`,
+		key, v); err != nil {
+		return "", err
+	}
+	got, ok, err := s.Get(ctx, key)
+	if err != nil {
+		return "", err
+	}
+	if !ok {
+		return "", fmt.Errorf("settings: %q missing after insert", key)
+	}
+	return got, nil
+}

backend/internal/settings/store.go

@@ -0,0 +1,62 @@
+package settings
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// Store is the PostgreSQL implementation of Repository.
+type Store struct {
+	pool *pgxpool.Pool
+}
+
+func NewStore(pool *pgxpool.Pool) *Store { return &Store{pool: pool} }
+
+func (s *Store) Get(ctx context.Context, key string) (string, bool, error) {
+	var v string
+	err := s.pool.QueryRow(ctx, `SELECT value FROM app_settings WHERE key = $1`, key).Scan(&v)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return "", false, nil
+		}
+		return "", false, err
+	}
+	return v, true, nil
+}
+
+func (s *Store) Set(ctx context.Context, key, value string) error {
+	_, err := s.pool.Exec(ctx,
+		`INSERT INTO app_settings (key, value) VALUES ($1, $2)
+		 ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = now()`,
+		key, value)
+	return err
+}
+
+func (s *Store) Ensure(ctx context.Context, key string, generate func() (string, error)) (string, error) {
+	if v, ok, err := s.Get(ctx, key); err != nil {
+		return "", err
+	} else if ok {
+		return v, nil
+	}
+	v, err := generate()
+	if err != nil {
+		return "", err
+	}
+	if _, err := s.pool.Exec(ctx,
+		`INSERT INTO app_settings (key, value) VALUES ($1, $2) ON CONFLICT (key) DO NOTHING`,
+		key, v); err != nil {
+		return "", err
+	}
+	got, ok, err := s.Get(ctx, key)
+	if err != nil {
+		return "", err
+	}
+	if !ok {
+		return "", fmt.Errorf("settings: %q missing after insert", key)
+	}
+	return got, nil
+}