feat: owner accounts and in-app platform settings

- First registered account becomes admin (users.is_admin, backfilled
  to earliest account); better-auth mirror path does the same
- Public registration closes after bootstrap; admin can reopen it via
  GET/PUT /api/v1/settings (admin-gated) or SIGNUP_ENABLED env
- In-app settings override env vars; secrets stored in app_settings,
  token values never returned by the API
- Saving a Cloudflare Tunnel token pulls and runs a managed
  cloudflared sidecar on the backend's networks; clearing removes it;
  startup restores it from saved settings
- group_add DOCKER_GID grants the non-root backend user Docker socket
  access; install.sh probes the in-container socket gid
- Settings page gains an owner-only Platform section (registration
  toggle, tunnel token, link to Cloudflare dashboard); sign-up page
  stays reachable while registration is open
- OpenAPI spec + generated types updated; manual user creation now
  requires admin

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docker-compose.yml

@@ -84,6 +84,13 @@ services:
       BITBUCKET_API_URL: ${BITBUCKET_API_URL:-https://api.bitbucket.org/2.0}
       BITBUCKET_BASE_URL: ${BITBUCKET_BASE_URL:-https://bitbucket.org}
       GITEA_BASE_URL: ${GITEA_BASE_URL:-https://gitea.example.com}
+    volumes:
+      # Required for service deployments and managed sidecars (e.g. cloudflared)
+      - /var/run/docker.sock:/var/run/docker.sock
+    # Grants the non-root backend user access to the Docker socket.
+    # install.sh writes the host's docker gid into DOCKER_GID.
+    group_add:
+      - "${DOCKER_GID:-0}"
     depends_on:
       postgres:
         condition: service_healthy