feat: owner accounts and in-app platform settings

- First registered account becomes admin (users.is_admin, backfilled
  to earliest account); better-auth mirror path does the same
- Public registration closes after bootstrap; admin can reopen it via
  GET/PUT /api/v1/settings (admin-gated) or SIGNUP_ENABLED env
- In-app settings override env vars; secrets stored in app_settings,
  token values never returned by the API
- Saving a Cloudflare Tunnel token pulls and runs a managed
  cloudflared sidecar on the backend's networks; clearing removes it;
  startup restores it from saved settings
- group_add DOCKER_GID grants the non-root backend user Docker socket
  access; install.sh probes the in-container socket gid
- Settings page gains an owner-only Platform section (registration
  toggle, tunnel token, link to Cloudflare dashboard); sign-up page
  stays reachable while registration is open
- OpenAPI spec + generated types updated; manual user creation now
  requires admin

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/frontend/src/features/auth/pages.tsx

@@ -279,7 +279,8 @@ export function SignUpPage() {
     return <Navigate to={redirectPath} replace />;
   }
 
-  if (bootstrapQuery.data?.mode === 'login') {
+  // Registration stays available when the owner reopened it in Settings.
+  if (bootstrapQuery.data?.mode === 'login' && !bootstrapQuery.data.signupEnabled) {
     return <Navigate to={`/auth/sign-in?redirect=${encodeURIComponent(redirectPath)}`} replace />;
   }
 
@@ -302,7 +303,12 @@ export function SignUpPage() {
 
   return (
     <AuthLayout>
-      <AuthCard title="Create Account" subtitle="Create first platform owner account. Registration closes after bootstrap.">
+      <AuthCard
+        title="Create Account"
+        subtitle={bootstrapQuery.data?.mode === 'register'
+          ? 'Create first platform owner account. Registration closes after bootstrap.'
+          : 'Create a new account.'}
+      >
         {error ? <AuthErrorNotice message={error} /> : null}
         {bootstrapQuery.isLoading ? <AuthInfoNotice message="Checking platform bootstrap state..." /> : null}
         {bootstrapQuery.isError ? <AuthErrorNotice message="Cannot reach the Containr API - check that the backend container is running." /> : null}