feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/internal/settings/settings.go

@@ -0,0 +1,20 @@
+// Package settings persists application-level key/value settings in the
+// metadata layer. The main use is the token signing secret, generated on first
+// use and reused afterwards.
+package settings
+
+import "context"
+
+// JWTSecretKey is the settings key holding the token signing secret.
+const JWTSecretKey = "jwt_secret"
+
+// Repository reads and writes application settings.
+type Repository interface {
+	// Get returns the value for key and whether it exists.
+	Get(ctx context.Context, key string) (string, bool, error)
+	// Set stores or replaces the value for key.
+	Set(ctx context.Context, key, value string) error
+	// Ensure returns the existing value for key, or generates and stores one
+	// using generate when absent. Concurrent first use yields one value.
+	Ensure(ctx context.Context, key string, generate func() (string, error)) (string, error)
+}