feat: instance administration, bootstrap admin, and managed-tier OAuth gate

Self-hosted instances are now email/password only — OAuth providers
(GitHub/Google/Discord/Microsoft) activate solely when PRIMORA_MANAGED=true,
reserved for the future hosted tier.

Sign-up lifecycle: the first public sign-up becomes the instance admin; after
bootstrap, sign-up closes by default. A better-auth databaseHook gates only
/sign-up/email, so admin-created users and OAuth flows bypass it. The login
page reads GET /instance/public to hide the sign-up tab, show the bootstrap
notice, and render only the providers the instance offers.

Instance settings live in core.settings (migration 00010) and resolve
in-app > env > built-in default, cached 15s. Platform admins (better-auth
user.role) manage sign-up, mail transport, and rate limits via
GET/PUT/DELETE /instance/settings or the new Settings → Instance tab. Secret
values are AES-256-GCM encrypted at rest with PRIMORA_ENCRYPTION_KEY, never
returned by the API, and decrypted by the auth service at send time.

Auth service reads the same settings table for the sign-up gate and mail
config, so in-app changes take effect without a restart.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/middleware/context.go

@@ -37,6 +37,9 @@ type AuthMiddleware struct {
 	Redis      *redis.Client
 	Verifier   *auth.Verifier
 	RateLimits RateLimitConfig
+	// RateLimitResolver overrides RateLimits with live instance settings when
+	// set — it resolves "user" and "api_key" limits per request (cached).
+	RateLimitResolver func(ctx context.Context, scope string) int
 }
 
 type RateLimitConfig struct {
@@ -44,6 +47,16 @@ type RateLimitConfig struct {
 	UserPerMinute   int
 }
 
+func (m AuthMiddleware) rateLimit(ctx context.Context, scope string, fallback int) int {
+	if m.RateLimitResolver == nil {
+		return fallback
+	}
+	if v := m.RateLimitResolver(ctx, scope); v >= 0 {
+		return v
+	}
+	return fallback
+}
+
 func RequestID() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		requestID := c.Request.Header.Get("X-Request-ID")
@@ -105,7 +118,7 @@ func (m AuthMiddleware) ResolveActor() gin.HandlerFunc {
 				if actor.UserID != nil {
 					userIdentity = actor.UserID.String()
 				}
-				if !m.enforceRateLimit(c, "user", userIdentity, m.RateLimits.UserPerMinute, "User rate limit exceeded") {
+				if !m.enforceRateLimit(c, "user", userIdentity, m.rateLimit(c.Request.Context(), "user", m.RateLimits.UserPerMinute), "User rate limit exceeded") {
 					return
 				}
 				c.Set(actorKey, actor)
@@ -123,7 +136,7 @@ func (m AuthMiddleware) ResolveActor() gin.HandlerFunc {
 				apperrors.Abort(c, http.StatusUnauthorized, "invalid_api_key", err.Error())
 				return
 			}
-			if !m.enforceRateLimit(c, "apikey", actor.APIKeyPrefix, m.RateLimits.APIKeyPerMinute, "API key rate limit exceeded") {
+			if !m.enforceRateLimit(c, "apikey", actor.APIKeyPrefix, m.rateLimit(c.Request.Context(), "api_key", m.RateLimits.APIKeyPerMinute), "API key rate limit exceeded") {
 				return
 			}
 			if need := requiredAPIKeyScope(c.Request.Method, c.Request.URL.Path); !actor.HasScope(need) {