feat: owner accounts and in-app platform settings

- First registered account becomes admin (users.is_admin, backfilled
  to earliest account); better-auth mirror path does the same
- Public registration closes after bootstrap; admin can reopen it via
  GET/PUT /api/v1/settings (admin-gated) or SIGNUP_ENABLED env
- In-app settings override env vars; secrets stored in app_settings,
  token values never returned by the API
- Saving a Cloudflare Tunnel token pulls and runs a managed
  cloudflared sidecar on the backend's networks; clearing removes it;
  startup restores it from saved settings
- group_add DOCKER_GID grants the non-root backend user Docker socket
  access; install.sh probes the in-container socket gid
- Settings page gains an owner-only Platform section (registration
  toggle, tunnel token, link to Cloudflare dashboard); sign-up page
  stays reachable while registration is open
- OpenAPI spec + generated types updated; manual user creation now
  requires admin

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.env.example

@@ -120,10 +120,21 @@ TRAEFIK_AUTH=admin:$$apr1$$b8mh8c8v$$KkR8hQZQZQZQZQZQZQZQZ/
 # Development convenience: true in local dev, false in production
 TRAEFIK_API_INSECURE=true
 
-# Optional: Cloudflare Tunnel (alternative to domain)
+# Optional: Cloudflare Tunnel (alternative to domain). Can also be set in-app
+# under Settings > Platform (in-app value overrides this).
 # Get token from: https://dash.cloudflare.com/argotunnel
 CLOUDFLARED_TOKEN=your_cloudflare_tunnel_token_here
 
+# Optional: reopen public registration after the owner account exists.
+# Manageable in-app under Settings > Platform (in-app value overrides this).
+# SIGNUP_ENABLED=false
+
+# Docker socket gid AS SEEN INSIDE containers - lets the backend manage
+# containers (deployments, cloudflared sidecar). install.sh detects it with a
+# throwaway container. Modern Docker maps the socket to root: use 0.
+# Older daemons expose the host docker gid: stat -c %g /var/run/docker.sock
+DOCKER_GID=0
+
 # Optional: Custom Docker Registry
 # DOCKER_REGISTRY=your-registry.com
 # DOCKER_USERNAME=your_username