feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/internal/store/store.go

@@ -13,6 +13,7 @@ import (
 	"shared-album/internal/members"
 	"shared-album/internal/notifications"
 	"shared-album/internal/photos"
+	"shared-album/internal/settings"
 	"shared-album/internal/sharelinks"
 	"shared-album/internal/social"
 )
@@ -26,6 +27,7 @@ type Repos struct {
 	Social        social.Repository
 	Notifications notifications.Repository
 	ShareLinks    sharelinks.Repository
+	Settings      settings.Repository
 }
 
 // NewPostgres builds the repositories backed by PostgreSQL.
@@ -38,6 +40,7 @@ func NewPostgres(pool *pgxpool.Pool) Repos {
 		Social:        social.NewStore(pool),
 		Notifications: notifications.NewStore(pool),
 		ShareLinks:    sharelinks.NewStore(pool),
+		Settings:      settings.NewStore(pool),
 	}
 }
 
@@ -51,5 +54,6 @@ func NewSQLite(db *sql.DB) Repos {
 		Social:        social.NewSQLiteStore(db),
 		Notifications: notifications.NewSQLiteStore(db),
 		ShareLinks:    sharelinks.NewSQLiteStore(db),
+		Settings:      settings.NewSQLiteStore(db),
 	}
 }