M1.5 backend: admin role + DB-backed settings, DB-URL-only install

- users.is_admin; first registered user becomes admin; registration gated by the
  allow_registration setting (first account always allowed). is_admin in
  /api/auth/* responses; require_admin guard (live DB check).
- settings table + code registry (site_name, allow_registration, session_ttl_days)
  with typed defaults — empty table = all defaults (rule 26). get/set/validate
  service; GET /api/config (public) + GET/PATCH /api/settings (admin), live
  session-TTL apply with no restart (rule 25).
- Cookie-signing secret now persisted in the DB (before_serving load-or-create),
  so sessions survive restarts with no volume. Config: DATABASE_URL is the only
  required env; SECRET_KEY + DATA_DIR are optional break-glass items.
- Migration 0003; DB-free tests for settings validation + admin guard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

src/thoughtsync/models/all.py

@@ -3,4 +3,4 @@
 Imported for side effects only (model registration on Base.metadata).
 """
 
-from . import group, note, share, user  # noqa: F401
+from . import group, note, settings, share, user  # noqa: F401

src/thoughtsync/models/settings.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import DateTime, Text, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from . import Base
+
+
+class Setting(Base):
+    """A single persisted key/value setting. Values are JSON-encoded text; the
+    typed defaults + metadata live in the code registry (thoughtsync.settings), so
+    an empty table means "all defaults" (rule 26)."""
+
+    __tablename__ = "settings"
+
+    key: Mapped[str] = mapped_column(Text(), primary_key=True)
+    value: Mapped[str] = mapped_column(Text(), nullable=False)
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now(), onupdate=func.now()
+    )

src/thoughtsync/models/user.py

@@ -17,6 +17,8 @@ class User(Base):
     # CITEXT so lookups/uniqueness are case-insensitive without lower() everywhere.
     email: Mapped[str] = mapped_column(CITEXT(), nullable=False, unique=True)
     email_verified: Mapped[bool] = mapped_column(Boolean(), nullable=False, server_default=func.false())
+    # First registered user becomes admin (see auth.register); admin gates Settings.
+    is_admin: Mapped[bool] = mapped_column(Boolean(), nullable=False, server_default=func.false())
     # Nullable: leaves room for external-identity-only accounts later (rule 26).
     password_hash: Mapped[str | None] = mapped_column(Text(), nullable=True)
     display_name: Mapped[str] = mapped_column(Text(), nullable=False)