feat: instance administration, bootstrap admin, and managed-tier OAuth gate

Self-hosted instances are now email/password only — OAuth providers
(GitHub/Google/Discord/Microsoft) activate solely when PRIMORA_MANAGED=true,
reserved for the future hosted tier.

Sign-up lifecycle: the first public sign-up becomes the instance admin; after
bootstrap, sign-up closes by default. A better-auth databaseHook gates only
/sign-up/email, so admin-created users and OAuth flows bypass it. The login
page reads GET /instance/public to hide the sign-up tab, show the bootstrap
notice, and render only the providers the instance offers.

Instance settings live in core.settings (migration 00010) and resolve
in-app > env > built-in default, cached 15s. Platform admins (better-auth
user.role) manage sign-up, mail transport, and rate limits via
GET/PUT/DELETE /instance/settings or the new Settings → Instance tab. Secret
values are AES-256-GCM encrypted at rest with PRIMORA_ENCRYPTION_KEY, never
returned by the API, and decrypted by the auth service at send time.

Auth service reads the same settings table for the sign-up gate and mail
config, so in-app changes take effect without a restart.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/frontend/src/lib/demo-mode.ts

@@ -23,6 +23,7 @@ import type {
   Document,
   IntegrationAnalytics,
   IntegrationTestResult,
+  InstanceSetting,
   MeResponse,
   MetricPoint,
   OrganizationSummary,
@@ -608,6 +609,19 @@ class DemoService {
     }));
   }
   async listAuthUsers() { await this.delay(); return authUsers; }
+
+  // Mirrors InstanceService.listInstanceSettings — representative registry
+  // slice so demo mode can show the Instance settings tab.
+  async listInstanceSettings(): Promise<InstanceSetting[]> {
+    await this.delay();
+    return [
+      { key: "auth.signup_enabled", type: "bool", secret: false, is_set: false, source: "default", value: false },
+      { key: "mail.from", type: "string", secret: false, is_set: false, source: "env", value: "Primora <[email protected]>" },
+      { key: "mail.smtp_host", type: "string", secret: false, is_set: true, source: "app", value: "mailpit" },
+      { key: "mail.smtp_password", type: "string", secret: true, is_set: false, source: "default" },
+      { key: "ratelimit.user_per_minute", type: "int", secret: false, is_set: false, source: "default", value: 240 },
+    ] as InstanceSetting[];
+  }
   async listCollections() { await this.delay(); return collections; }
   async listDocuments() { await this.delay(); return documents; }