feat: instance administration, bootstrap admin, and managed-tier OAuth gate

Self-hosted instances are now email/password only — OAuth providers
(GitHub/Google/Discord/Microsoft) activate solely when PRIMORA_MANAGED=true,
reserved for the future hosted tier.

Sign-up lifecycle: the first public sign-up becomes the instance admin; after
bootstrap, sign-up closes by default. A better-auth databaseHook gates only
/sign-up/email, so admin-created users and OAuth flows bypass it. The login
page reads GET /instance/public to hide the sign-up tab, show the bootstrap
notice, and render only the providers the instance offers.

Instance settings live in core.settings (migration 00010) and resolve
in-app > env > built-in default, cached 15s. Platform admins (better-auth
user.role) manage sign-up, mail transport, and rate limits via
GET/PUT/DELETE /instance/settings or the new Settings → Instance tab. Secret
values are AES-256-GCM encrypted at rest with PRIMORA_ENCRYPTION_KEY, never
returned by the API, and decrypted by the auth service at send time.

Auth service reads the same settings table for the sign-up gate and mail
config, so in-app changes take effect without a restart.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/repositories/core_repository.go

@@ -56,3 +56,35 @@ func (r *CoreRepository) GetAPIKeyByPrefix(ctx context.Context, prefix string) (
 func (r *CoreRepository) TouchAPIKey(ctx context.Context, id uuid.UUID) error {
 	return r.queries.TouchAPIKey(ctx, id)
 }
+
+// Auth-user lookups hit the better-auth tables in the public schema. They are
+// raw queries on purpose: sqlc only knows the core schema, and a view would
+// break when the backend migrates before the auth service has created its
+// tables.
+func (r *CoreRepository) GetAuthUserRole(ctx context.Context, authSubject string) (string, error) {
+	var role string
+	err := r.pool.QueryRow(ctx, `select coalesce(role, 'user') from public."user" where id = $1`, authSubject).Scan(&role)
+	return role, err
+}
+
+func (r *CoreRepository) CountAuthUsers(ctx context.Context) (int64, error) {
+	var n int64
+	err := r.pool.QueryRow(ctx, `select count(*) from public."user"`).Scan(&n)
+	return n, err
+}
+
+func (r *CoreRepository) GetSetting(ctx context.Context, key string) (db.GetSettingRow, error) {
+	return r.queries.GetSetting(ctx, key)
+}
+
+func (r *CoreRepository) ListSettings(ctx context.Context) ([]db.ListSettingsRow, error) {
+	return r.queries.ListSettings(ctx)
+}
+
+func (r *CoreRepository) UpsertSetting(ctx context.Context, params db.UpsertSettingParams) (db.CoreSetting, error) {
+	return r.queries.UpsertSetting(ctx, params)
+}
+
+func (r *CoreRepository) DeleteSetting(ctx context.Context, key string) error {
+	return r.queries.DeleteSetting(ctx, key)
+}