feat: runtime self-registration toggle in admin dashboard

Self-registration is now controlled at runtime from the admin panel rather
than at build time via an env var. Default: off.

- New `settings` table (key/value/updated_at) plus getSetting/setSetting
  helpers. Idempotent first-boot migration seeds allow_self_registration
  from the ALLOW_SELF_REGISTRATION env var; after first boot the env var
  is ignored and admins control the toggle from the UI.
- New public GET /api/auth/config (no auth) — returns
  { allowSelfRegistration, hasUsers }. The Login page polls this on mount
  to decide whether to show a Register link, and to render
  "Create the first admin account" mode when the install is empty.
- New admin GET /api/admin/settings + PUT /api/admin/settings/:key for
  the dashboard. Constrained to a known-keys allowlist with type coercion
  so unrecognized keys can't be stored.
- POST /api/auth/register now reads the toggle from the database instead
  of process.env. The first user is still always allowed and is auto-
  promoted to admin.
- Admin.tsx grows a "Settings" card with a labelled toggle switch and
  toast feedback. The card sits above the user table.
- VITE_ALLOW_SELF_REGISTRATION dropped — runtime fetch replaces it.

Docs: README + .env.example clarify that ALLOW_SELF_REGISTRATION is now
an initial seed only, the going-public checklist points at the dashboard
toggle, and the features list calls out runtime control.

backend/routes/auth.js

@@ -6,6 +6,7 @@ const {
   createUser,
   getUserById,
   getUserCount,
+  getBoolSetting,
 } = require('../db');
 const {
   hashPassword,
@@ -16,6 +17,24 @@ const {
 
 const router = Router();
 
+/**
+ * GET /api/auth/config
+ * Public, no auth — used by the Login page to decide whether to show the
+ * "Register" link. Only exposes booleans the UI needs; no internals.
+ */
+router.get('/config', (_req, res) => {
+  try {
+    const userCount = getUserCount();
+    return res.json({
+      allowSelfRegistration: getBoolSetting('allow_self_registration', false),
+      hasUsers: userCount > 0,
+    });
+  } catch (err) {
+    console.error('[auth] config error:', err);
+    return res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
 /**
  * POST /api/auth/register
  * Create a new user. The first user automatically becomes admin.
@@ -32,8 +51,8 @@ router.post('/register', async (req, res) => {
       return res.status(400).json({ error: 'Password must be at least 6 characters' });
     }
 
-    const allowRegistration = (process.env.ALLOW_SELF_REGISTRATION || '').toLowerCase() === 'true';
     const userCount = getUserCount();
+    const allowRegistration = getBoolSetting('allow_self_registration', false);
     if (!allowRegistration && userCount > 0) {
       return res.status(403).json({
         error: 'Self-registration is disabled. Ask an admin to create your account.',