feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

project.md

@@ -159,11 +159,11 @@ S3_USE_PATH_STYLE=true
 # Storage backend
 STORAGE_BACKEND=fs          # fs (default, local filesystem) | s3
 FS_ROOT=./data                  # root directory for object blobs (fs)
-URL_SECRET=change_me            # signs object URLs; falls back to JWT_SECRET
+URL_SECRET=change_me            # signs object URLs; falls back to the metadata-layer secret
 OBJECT_URL_TTL=1h               # lifetime of signed object URLs
 
-# Auth
-JWT_SECRET=change_me_long_random
+# Auth. Token signing secret is generated on first start and stored in the
+# metadata layer (app_settings) — not configured via env.
 JWT_ACCESS_TTL=15m
 JWT_REFRESH_TTL=720h