feat: instance administration, bootstrap admin, and managed-tier OAuth gate

Self-hosted instances are now email/password only — OAuth providers
(GitHub/Google/Discord/Microsoft) activate solely when PRIMORA_MANAGED=true,
reserved for the future hosted tier.

Sign-up lifecycle: the first public sign-up becomes the instance admin; after
bootstrap, sign-up closes by default. A better-auth databaseHook gates only
/sign-up/email, so admin-created users and OAuth flows bypass it. The login
page reads GET /instance/public to hide the sign-up tab, show the bootstrap
notice, and render only the providers the instance offers.

Instance settings live in core.settings (migration 00010) and resolve
in-app > env > built-in default, cached 15s. Platform admins (better-auth
user.role) manage sign-up, mail transport, and rate limits via
GET/PUT/DELETE /instance/settings or the new Settings → Instance tab. Secret
values are AES-256-GCM encrypted at rest with PRIMORA_ENCRYPTION_KEY, never
returned by the API, and decrypted by the auth service at send time.

Auth service reads the same settings table for the sign-up gate and mail
config, so in-app changes take effect without a restart.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/handlers/http.go

@@ -20,6 +20,7 @@ import (
 
 type HTTPHandler struct {
 	Platform  *services.PlatformService
+	Settings  *services.SettingsService
 	Validate  *validator.Validate
 	Metrics   *observability.Metrics
 	Readiness func(*gin.Context) map[string]any
@@ -33,6 +34,10 @@ func (h *HTTPHandler) Register(router *gin.Engine) {
 
 	api := router.Group("/api/v1")
 	api.GET("/me", h.me)
+	api.GET("/instance/public", h.instancePublic)
+	api.GET("/instance/settings", h.listInstanceSettings)
+	api.PUT("/instance/settings/:key", h.updateInstanceSetting)
+	api.DELETE("/instance/settings/:key", h.deleteInstanceSetting)
 	api.POST("/bootstrap", h.bootstrap)
 	api.GET("/organizations", h.organizations)
 	api.POST("/organizations", h.createOrganization)