feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/internal/storage/storage.go

@@ -98,11 +98,15 @@ func (c *S3) Bucket() string { return c.bucket }
 
 // Open builds the storage backend selected by configuration: S3-compatible by
 // default, or the local file system when STORAGE_BACKEND=fs. Every backend
-// delivers blobs through the app using a shared Signer.
-func Open(ctx context.Context, cfg *config.Config) (Backend, error) {
+// delivers blobs through the app using a shared Signer. jwtSecret is the
+// application secret used to sign object URLs when URL_SECRET is not set.
+func Open(ctx context.Context, cfg *config.Config, jwtSecret string) (Backend, error) {
 	secret := cfg.Storage.URLSecret
 	if secret == "" {
-		secret = cfg.Auth.JWTSecret
+		secret = jwtSecret
+	}
+	if secret == "" {
+		return nil, errors.New("object URL secret is not available")
 	}
 	signer, err := NewSigner(cfg.Server.BaseURL, secret, cfg.Storage.URLTTL)
 	if err != nil {