feat: instance administration, bootstrap admin, and managed-tier OAuth gate

Self-hosted instances are now email/password only — OAuth providers
(GitHub/Google/Discord/Microsoft) activate solely when PRIMORA_MANAGED=true,
reserved for the future hosted tier.

Sign-up lifecycle: the first public sign-up becomes the instance admin; after
bootstrap, sign-up closes by default. A better-auth databaseHook gates only
/sign-up/email, so admin-created users and OAuth flows bypass it. The login
page reads GET /instance/public to hide the sign-up tab, show the bootstrap
notice, and render only the providers the instance offers.

Instance settings live in core.settings (migration 00010) and resolve
in-app > env > built-in default, cached 15s. Platform admins (better-auth
user.role) manage sign-up, mail transport, and rate limits via
GET/PUT/DELETE /instance/settings or the new Settings → Instance tab. Secret
values are AES-256-GCM encrypted at rest with PRIMORA_ENCRYPTION_KEY, never
returned by the API, and decrypted by the auth service at send time.

Auth service reads the same settings table for the sign-up gate and mail
config, so in-app changes take effect without a restart.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.env.example

@@ -29,6 +29,14 @@ BETTER_AUTH_SECRET=change-me-super-long-better-auth-secret
 BETTER_AUTH_URL=http://localhost/auth
 # Comma-separated emails promoted to auth admin on boot (Authentication → Users panel)
 AUTH_ADMIN_EMAILS=
+# The first public sign-up always becomes the instance admin. With no users the
+# login page shows only the sign-up form. After bootstrap, public sign-up is
+# closed unless SIGNUP_ENABLED=true or the admin enables it in-app
+# (Settings → Instance). In-app values override this file.
+SIGNUP_ENABLED=false
+# Managed tier flag — OAuth providers activate only when this is "true".
+# Self-hosted instances are email/password regardless of the keys below.
+PRIMORA_MANAGED=false
 COOKIE_DOMAIN=localhost
 
 FRONTEND_PORT=3000
@@ -42,6 +50,8 @@ BACKEND_PUBLIC_URL=http://localhost/api/v1
 BACKEND_INTERNAL_URL=http://backend:8080
 BACKEND_STORAGE_ROOT=/data/storage
 
+# Mail defaults — each is overridable in-app (Settings → Instance). In-app
+# values win over these env vars; deleting the in-app value reverts here.
 RESEND_API_KEY=
 MAIL_FROM=Primora <[email protected]>
 SMTP_HOST=mailpit
@@ -50,6 +60,7 @@ SMTP_USER=
 SMTP_PASSWORD=
 SMTP_SECURE=false
 
+# OAuth keys only take effect when PRIMORA_MANAGED=true (managed tier).
 GITHUB_CLIENT_ID=
 GITHUB_CLIENT_SECRET=
 GOOGLE_CLIENT_ID=