feat: instance administration, bootstrap admin, and managed-tier OAuth gate

Self-hosted instances are now email/password only — OAuth providers
(GitHub/Google/Discord/Microsoft) activate solely when PRIMORA_MANAGED=true,
reserved for the future hosted tier.

Sign-up lifecycle: the first public sign-up becomes the instance admin; after
bootstrap, sign-up closes by default. A better-auth databaseHook gates only
/sign-up/email, so admin-created users and OAuth flows bypass it. The login
page reads GET /instance/public to hide the sign-up tab, show the bootstrap
notice, and render only the providers the instance offers.

Instance settings live in core.settings (migration 00010) and resolve
in-app > env > built-in default, cached 15s. Platform admins (better-auth
user.role) manage sign-up, mail transport, and rate limits via
GET/PUT/DELETE /instance/settings or the new Settings → Instance tab. Secret
values are AES-256-GCM encrypted at rest with PRIMORA_ENCRYPTION_KEY, never
returned by the API, and decrypted by the auth service at send time.

Auth service reads the same settings table for the sign-up gate and mail
config, so in-app changes take effect without a restart.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/auth/src/lib/env.ts

@@ -18,6 +18,15 @@ const envSchema = z.object({
   SMTP_PORT: z.string().default("1025"),
   SMTP_USER: z.string().optional(),
   SMTP_PASSWORD: z.string().optional(),
+  // Managed tier flag — OAuth providers only activate when this is "true".
+  // Self-hosted instances are email/password only.
+  PRIMORA_MANAGED: z.string().optional(),
+  // Bootstrap override for public sign-up. Without it (or an in-app setting),
+  // sign-up is closed once the first user exists.
+  SIGNUP_ENABLED: z.string().optional(),
+  // Decrypts secret instance settings written by the backend (mail keys etc.).
+  PRIMORA_ENCRYPTION_KEY: z.string().optional(),
+  SMTP_SECURE: z.string().optional(),
   GITHUB_CLIENT_ID: z.string().optional(),
   GITHUB_CLIENT_SECRET: z.string().optional(),
   GOOGLE_CLIENT_ID: z.string().optional(),
@@ -44,5 +53,8 @@ export const env = {
   JWT_TTL_SECONDS: Number(parsed.data.JWT_TTL_SECONDS),
   SMTP_PORT: Number(parsed.data.SMTP_PORT),
   AUTH_BASE_URL: parsed.data.AUTH_BASE_URL ?? parsed.data.BETTER_AUTH_URL,
+  PRIMORA_MANAGED: parsed.data.PRIMORA_MANAGED === "true",
+  SIGNUP_ENABLED: parsed.data.SIGNUP_ENABLED === "true",
+  SMTP_SECURE: parsed.data.SMTP_SECURE === "true",
 };