feat: instance administration, bootstrap admin, and managed-tier OAuth gate

Self-hosted instances are now email/password only — OAuth providers
(GitHub/Google/Discord/Microsoft) activate solely when PRIMORA_MANAGED=true,
reserved for the future hosted tier.

Sign-up lifecycle: the first public sign-up becomes the instance admin; after
bootstrap, sign-up closes by default. A better-auth databaseHook gates only
/sign-up/email, so admin-created users and OAuth flows bypass it. The login
page reads GET /instance/public to hide the sign-up tab, show the bootstrap
notice, and render only the providers the instance offers.

Instance settings live in core.settings (migration 00010) and resolve
in-app > env > built-in default, cached 15s. Platform admins (better-auth
user.role) manage sign-up, mail transport, and rate limits via
GET/PUT/DELETE /instance/settings or the new Settings → Instance tab. Secret
values are AES-256-GCM encrypted at rest with PRIMORA_ENCRYPTION_KEY, never
returned by the API, and decrypted by the auth service at send time.

Auth service reads the same settings table for the sign-up gate and mail
config, so in-app changes take effect without a restart.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

packages/api-client/src/generated/index.ts

@@ -69,6 +69,9 @@ export type { HealthStatus } from './models/HealthStatus';
 export { IngestEvent } from './models/IngestEvent';
 export type { IngestRequest } from './models/IngestRequest';
 export type { IngestResponse } from './models/IngestResponse';
+export type { InstancePublicConfig } from './models/InstancePublicConfig';
+export { InstanceSetting } from './models/InstanceSetting';
+export type { InstanceSettingsResponse } from './models/InstanceSettingsResponse';
 export { Integration } from './models/Integration';
 export type { IntegrationAnalytics } from './models/IntegrationAnalytics';
 export type { IntegrationID } from './models/IntegrationID';
@@ -115,6 +118,7 @@ export type { UpdateBucketObjectRequest } from './models/UpdateBucketObjectReque
 export { UpdateBucketRequest } from './models/UpdateBucketRequest';
 export type { UpdateCollectionRequest } from './models/UpdateCollectionRequest';
 export type { UpdateDocumentRequest } from './models/UpdateDocumentRequest';
+export type { UpdateInstanceSettingRequest } from './models/UpdateInstanceSettingRequest';
 export { UpdateOrganizationMemberRoleRequest } from './models/UpdateOrganizationMemberRoleRequest';
 export type { UpdateOrganizationRequest } from './models/UpdateOrganizationRequest';
 export { UpdateProjectMemberRoleRequest } from './models/UpdateProjectMemberRoleRequest';
@@ -192,6 +196,9 @@ export { $HealthStatus } from './schemas/$HealthStatus';
 export { $IngestEvent } from './schemas/$IngestEvent';
 export { $IngestRequest } from './schemas/$IngestRequest';
 export { $IngestResponse } from './schemas/$IngestResponse';
+export { $InstancePublicConfig } from './schemas/$InstancePublicConfig';
+export { $InstanceSetting } from './schemas/$InstanceSetting';
+export { $InstanceSettingsResponse } from './schemas/$InstanceSettingsResponse';
 export { $Integration } from './schemas/$Integration';
 export { $IntegrationAnalytics } from './schemas/$IntegrationAnalytics';
 export { $IntegrationID } from './schemas/$IntegrationID';
@@ -238,6 +245,7 @@ export { $UpdateBucketObjectRequest } from './schemas/$UpdateBucketObjectRequest
 export { $UpdateBucketRequest } from './schemas/$UpdateBucketRequest';
 export { $UpdateCollectionRequest } from './schemas/$UpdateCollectionRequest';
 export { $UpdateDocumentRequest } from './schemas/$UpdateDocumentRequest';
+export { $UpdateInstanceSettingRequest } from './schemas/$UpdateInstanceSettingRequest';
 export { $UpdateOrganizationMemberRoleRequest } from './schemas/$UpdateOrganizationMemberRoleRequest';
 export { $UpdateOrganizationRequest } from './schemas/$UpdateOrganizationRequest';
 export { $UpdateProjectMemberRoleRequest } from './schemas/$UpdateProjectMemberRoleRequest';
@@ -257,6 +265,7 @@ export { AutomationService } from './services/AutomationService';
 export { CollectionsService } from './services/CollectionsService';
 export { DatabasesService } from './services/DatabasesService';
 export { HealthService } from './services/HealthService';
+export { InstanceService } from './services/InstanceService';
 export { IntegrationsService } from './services/IntegrationsService';
 export { OrganizationsService } from './services/OrganizationsService';
 export { PlatformService } from './services/PlatformService';

packages/api-client/src/generated/models/InstancePublicConfig.ts

@@ -0,0 +1,19 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type InstancePublicConfig = {
+    /**
+     * Whether public sign-up is open (bootstrap always allowed)
+     */
+    signup_enabled: boolean;
+    /**
+     * True when no user exists yet — first sign-up becomes instance admin
+     */
+    bootstrap_required: boolean;
+    /**
+     * Enabled OAuth providers — empty on self-hosted
+     */
+    social_providers: Array<string>;
+};
+

packages/api-client/src/generated/models/InstanceSetting.ts

@@ -0,0 +1,31 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type InstanceSetting = {
+    key: string;
+    type: InstanceSetting.type;
+    secret: boolean;
+    /**
+     * True when an in-app override exists
+     */
+    is_set: boolean;
+    source: InstanceSetting.source;
+    /**
+     * Effective value — never returned for secret keys
+     */
+    value?: any;
+};
+export namespace InstanceSetting {
+    export enum type {
+        BOOL = 'bool',
+        INT = 'int',
+        STRING = 'string',
+    }
+    export enum source {
+        APP = 'app',
+        ENV = 'env',
+        DEFAULT = 'default',
+    }
+}
+

packages/api-client/src/generated/models/InstanceSettingsResponse.ts

@@ -0,0 +1,9 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+import type { InstanceSetting } from './InstanceSetting';
+export type InstanceSettingsResponse = {
+    settings: Array<InstanceSetting>;
+};
+

packages/api-client/src/generated/models/UpdateInstanceSettingRequest.ts

@@ -0,0 +1,11 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type UpdateInstanceSettingRequest = {
+    /**
+     * JSON value matching the key's declared type
+     */
+    value: any;
+};
+

packages/api-client/src/generated/schemas/$InstancePublicConfig.ts

@@ -0,0 +1,25 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $InstancePublicConfig = {
+    properties: {
+        signup_enabled: {
+            type: 'boolean',
+            description: `Whether public sign-up is open (bootstrap always allowed)`,
+            isRequired: true,
+        },
+        bootstrap_required: {
+            type: 'boolean',
+            description: `True when no user exists yet — first sign-up becomes instance admin`,
+            isRequired: true,
+        },
+        social_providers: {
+            type: 'array',
+            contains: {
+                type: 'string',
+            },
+            isRequired: true,
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$InstanceSetting.ts

@@ -0,0 +1,34 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $InstanceSetting = {
+    properties: {
+        key: {
+            type: 'string',
+            isRequired: true,
+        },
+        type: {
+            type: 'Enum',
+            isRequired: true,
+        },
+        secret: {
+            type: 'boolean',
+            isRequired: true,
+        },
+        is_set: {
+            type: 'boolean',
+            description: `True when an in-app override exists`,
+            isRequired: true,
+        },
+        source: {
+            type: 'Enum',
+            isRequired: true,
+        },
+        value: {
+            description: `Effective value — never returned for secret keys`,
+            properties: {
+            },
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$InstanceSettingsResponse.ts

@@ -0,0 +1,15 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $InstanceSettingsResponse = {
+    properties: {
+        settings: {
+            type: 'array',
+            contains: {
+                type: 'InstanceSetting',
+            },
+            isRequired: true,
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$UpdateInstanceSettingRequest.ts

@@ -0,0 +1,14 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $UpdateInstanceSettingRequest = {
+    properties: {
+        value: {
+            description: `JSON value matching the key's declared type`,
+            properties: {
+            },
+            isRequired: true,
+        },
+    },
+} as const;

packages/api-client/src/generated/services/InstanceService.ts

@@ -0,0 +1,88 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+import type { InstancePublicConfig } from '../models/InstancePublicConfig';
+import type { InstanceSetting } from '../models/InstanceSetting';
+import type { InstanceSettingsResponse } from '../models/InstanceSettingsResponse';
+import type { UpdateInstanceSettingRequest } from '../models/UpdateInstanceSettingRequest';
+import type { CancelablePromise } from '../core/CancelablePromise';
+import { OpenAPI } from '../core/OpenAPI';
+import { request as __request } from '../core/request';
+export class InstanceService {
+    /**
+     * Public instance state for the login page — no auth required
+     * @returns InstancePublicConfig Public instance configuration
+     * @throws ApiError
+     */
+    public static getInstancePublic(): CancelablePromise<InstancePublicConfig> {
+        return __request(OpenAPI, {
+            method: 'GET',
+            url: '/instance/public',
+        });
+    }
+    /**
+     * List instance settings (platform admin only)
+     * @returns InstanceSettingsResponse Resolved instance settings
+     * @throws ApiError
+     */
+    public static listInstanceSettings(): CancelablePromise<InstanceSettingsResponse> {
+        return __request(OpenAPI, {
+            method: 'GET',
+            url: '/instance/settings',
+            errors: {
+                401: `Error response`,
+                403: `Error response`,
+            },
+        });
+    }
+    /**
+     * Set an instance setting override (platform admin only)
+     * @returns InstanceSetting Setting stored
+     * @throws ApiError
+     */
+    public static updateInstanceSetting({
+        key,
+        requestBody,
+    }: {
+        key: string,
+        requestBody: UpdateInstanceSettingRequest,
+    }): CancelablePromise<InstanceSetting> {
+        return __request(OpenAPI, {
+            method: 'PUT',
+            url: '/instance/settings/{key}',
+            path: {
+                'key': key,
+            },
+            body: requestBody,
+            mediaType: 'application/json',
+            errors: {
+                400: `Error response`,
+                403: `Error response`,
+                404: `Error response`,
+            },
+        });
+    }
+    /**
+     * Revert a setting to its env/default value (platform admin only)
+     * @returns void
+     * @throws ApiError
+     */
+    public static deleteInstanceSetting({
+        key,
+    }: {
+        key: string,
+    }): CancelablePromise<void> {
+        return __request(OpenAPI, {
+            method: 'DELETE',
+            url: '/instance/settings/{key}',
+            path: {
+                'key': key,
+            },
+            errors: {
+                403: `Error response`,
+                404: `Error response`,
+            },
+        });
+    }
+}