feat: owner accounts and in-app platform settings

- First registered account becomes admin (users.is_admin, backfilled
  to earliest account); better-auth mirror path does the same
- Public registration closes after bootstrap; admin can reopen it via
  GET/PUT /api/v1/settings (admin-gated) or SIGNUP_ENABLED env
- In-app settings override env vars; secrets stored in app_settings,
  token values never returned by the API
- Saving a Cloudflare Tunnel token pulls and runs a managed
  cloudflared sidecar on the backend's networks; clearing removes it;
  startup restores it from saved settings
- group_add DOCKER_GID grants the non-root backend user Docker socket
  access; install.sh probes the in-container socket gid
- Settings page gains an owner-only Platform section (registration
  toggle, tunnel token, link to Cloudflare dashboard); sign-up page
  stays reachable while registration is open
- OpenAPI spec + generated types updated; manual user creation now
  requires admin

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

install.sh

@@ -82,6 +82,16 @@ else
     sed -i.bak "s|your_secure_postgres_password|$PG_PASS|g" .env
     sed -i.bak "s|your_secure_redis_password|$REDIS_PASS|g" .env
 
+    # Docker socket gid as seen INSIDE containers (modern Docker maps it to
+    # root). Probe a throwaway container; fall back to the host gid, then 0.
+    if [[ -z "${DOCKER_GID:-}" ]]; then
+        DOCKER_GID="$(docker run --rm -v /var/run/docker.sock:/var/run/docker.sock alpine:3 stat -c %g /var/run/docker.sock 2>/dev/null \
+            || stat -c %g /var/run/docker.sock 2>/dev/null \
+            || stat -f %g /var/run/docker.sock 2>/dev/null \
+            || echo 0)"
+    fi
+    setvar DOCKER_GID "$DOCKER_GID"
+
     # Persist any overrides passed via the environment.
     for v in HTTP_PORT API_PORT POSTGRES_PORT REDIS_PORT CONTAINR_VERSION; do
         [[ -n "${!v:-}" ]] && setvar "$v" "${!v}"