feat: runtime self-registration toggle in admin dashboard

Self-registration is now controlled at runtime from the admin panel rather
than at build time via an env var. Default: off.

- New `settings` table (key/value/updated_at) plus getSetting/setSetting
  helpers. Idempotent first-boot migration seeds allow_self_registration
  from the ALLOW_SELF_REGISTRATION env var; after first boot the env var
  is ignored and admins control the toggle from the UI.
- New public GET /api/auth/config (no auth) — returns
  { allowSelfRegistration, hasUsers }. The Login page polls this on mount
  to decide whether to show a Register link, and to render
  "Create the first admin account" mode when the install is empty.
- New admin GET /api/admin/settings + PUT /api/admin/settings/:key for
  the dashboard. Constrained to a known-keys allowlist with type coercion
  so unrecognized keys can't be stored.
- POST /api/auth/register now reads the toggle from the database instead
  of process.env. The first user is still always allowed and is auto-
  promoted to admin.
- Admin.tsx grows a "Settings" card with a labelled toggle switch and
  toast feedback. The card sits above the user table.
- VITE_ALLOW_SELF_REGISTRATION dropped — runtime fetch replaces it.

Docs: README + .env.example clarify that ALLOW_SELF_REGISTRATION is now
an initial seed only, the going-public checklist points at the dashboard
toggle, and the features list calls out runtime control.

.env.example

@@ -43,16 +43,13 @@ SEED_ADMIN_USERNAME=
 SEED_ADMIN_DISPLAY_NAME=
 
 # ---- Self-registration ----
-# When "true", the public /api/auth/register endpoint accepts new signups.
-# When "false" (default), only admins can create accounts (via /api/admin/users).
+# Initial value for the runtime self-registration toggle. Default "false".
+# After the first boot this env var is IGNORED — admins control the toggle
+# from the dashboard at /admin (it's persisted in the database).
 # The very first user can always register, regardless of this flag, and is
 # auto-promoted to admin.
 ALLOW_SELF_REGISTRATION=false
 
-# Frontend mirror — controls whether the Login screen shows the "Register" link.
-# Must be set at *build* time (Vite) for the bundled frontend, not at runtime.
-VITE_ALLOW_SELF_REGISTRATION=false
-
 # ---- Optional: API key for bot / programmatic upload ----
 # If set, /api/upload/api-key endpoints require this header value.
 REFBOARD_API_KEY=