feat: runtime self-registration toggle in admin dashboard

Self-registration is now controlled at runtime from the admin panel rather
than at build time via an env var. Default: off.

- New `settings` table (key/value/updated_at) plus getSetting/setSetting
  helpers. Idempotent first-boot migration seeds allow_self_registration
  from the ALLOW_SELF_REGISTRATION env var; after first boot the env var
  is ignored and admins control the toggle from the UI.
- New public GET /api/auth/config (no auth) — returns
  { allowSelfRegistration, hasUsers }. The Login page polls this on mount
  to decide whether to show a Register link, and to render
  "Create the first admin account" mode when the install is empty.
- New admin GET /api/admin/settings + PUT /api/admin/settings/:key for
  the dashboard. Constrained to a known-keys allowlist with type coercion
  so unrecognized keys can't be stored.
- POST /api/auth/register now reads the toggle from the database instead
  of process.env. The first user is still always allowed and is auto-
  promoted to admin.
- Admin.tsx grows a "Settings" card with a labelled toggle switch and
  toast feedback. The card sits above the user table.
- VITE_ALLOW_SELF_REGISTRATION dropped — runtime fetch replaces it.

Docs: README + .env.example clarify that ALLOW_SELF_REGISTRATION is now
an initial seed only, the going-public checklist points at the dashboard
toggle, and the features list calls out runtime control.

backend/routes/admin.js

@@ -15,12 +15,69 @@ const {
   updateCollection,
   addCollectionMember,
   createBoard,
+  getAllSettings,
+  setSetting,
+  getBoolSetting,
 } = require('../db');
 
 const router = Router();
 
 router.use(adminOrApiKeyMiddleware);
 
+// ---- Settings ----
+
+const KNOWN_SETTINGS = {
+  allow_self_registration: { type: 'bool', default: false },
+};
+
+router.get('/settings', (_req, res) => {
+  try {
+    const stored = getAllSettings();
+    const map = Object.fromEntries(stored.map((s) => [s.key, s]));
+    const out = {};
+    for (const [key, def] of Object.entries(KNOWN_SETTINGS)) {
+      const row = map[key];
+      let value;
+      if (def.type === 'bool') {
+        value = row ? row.value === 'true' || row.value === '1' : def.default;
+      } else {
+        value = row ? row.value : def.default;
+      }
+      out[key] = { value, updated_at: row?.updated_at || null, type: def.type };
+    }
+    return res.json({ settings: out });
+  } catch (err) {
+    console.error('[admin] get settings error:', err);
+    return res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+router.put('/settings/:key', (req, res) => {
+  try {
+    const { key } = req.params;
+    const def = KNOWN_SETTINGS[key];
+    if (!def) {
+      return res.status(404).json({ error: `Unknown setting: ${key}` });
+    }
+    const raw = req.body?.value;
+    if (raw === undefined || raw === null) {
+      return res.status(400).json({ error: 'Missing "value" in request body' });
+    }
+    let stringValue;
+    if (def.type === 'bool') {
+      const b = raw === true || raw === 'true' || raw === 1 || raw === '1';
+      stringValue = b ? 'true' : 'false';
+    } else {
+      stringValue = String(raw);
+    }
+    setSetting(key, stringValue);
+    return res.json({ key, value: def.type === 'bool' ? stringValue === 'true' : stringValue });
+  } catch (err) {
+    console.error('[admin] set setting error:', err);
+    return res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
 // ---- User management ----
 
 router.post('/users', async (req, res) => {