feat(db/m7-user-mgmt): migration 0024 + self-service + SMTP queries (U3)

Adds users.email (optional, lowercase-unique via partial index),
smtp_config singleton, and password_resets tokens. Plus the
queries U3-T2 / T3 / T4 use:

- ChangeUserPassword: self-service password change. HTTP layer
  verifies the current password before this fires.
- UpdateUserProfile: set display_name + email together.
- RegenerateApiToken: invalidate old API token.
- GetUserByEmail: case-insensitive lookup for forgot-password.
- GetSMTPConfig + UpdateSMTPConfig: admin SMTP settings CRUD.
- CreatePasswordReset / GetPasswordReset / UsePasswordReset
  (:execrows for atomic claim) / DeleteExpiredPasswordResets
  (cron-style cleanup, not yet wired).

Email column is nullable; users without email have admin-reset
as their only password-recovery path. The lower() unique index
allows many NULLs and prevents case-insensitive duplicates.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/db/dbq/smtp_config.sql.go

@@ -0,0 +1,71 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: smtp_config.sql
+
+package dbq
+
+import (
+	"context"
+)
+
+const getSMTPConfig = `-- name: GetSMTPConfig :one
+SELECT id, enabled, host, port, username, password, from_address, from_name, use_tls, updated_at FROM smtp_config WHERE id = true
+`
+
+func (q *Queries) GetSMTPConfig(ctx context.Context) (SmtpConfig, error) {
+	row := q.db.QueryRow(ctx, getSMTPConfig)
+	var i SmtpConfig
+	err := row.Scan(
+		&i.ID,
+		&i.Enabled,
+		&i.Host,
+		&i.Port,
+		&i.Username,
+		&i.Password,
+		&i.FromAddress,
+		&i.FromName,
+		&i.UseTls,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const updateSMTPConfig = `-- name: UpdateSMTPConfig :exec
+UPDATE smtp_config
+   SET enabled      = $1,
+       host         = $2,
+       port         = $3,
+       username     = $4,
+       password     = $5,
+       from_address = $6,
+       from_name    = $7,
+       use_tls      = $8,
+       updated_at   = now()
+ WHERE id = true
+`
+
+type UpdateSMTPConfigParams struct {
+	Enabled     bool
+	Host        string
+	Port        int32
+	Username    string
+	Password    string
+	FromAddress string
+	FromName    string
+	UseTls      bool
+}
+
+func (q *Queries) UpdateSMTPConfig(ctx context.Context, arg UpdateSMTPConfigParams) error {
+	_, err := q.db.Exec(ctx, updateSMTPConfig,
+		arg.Enabled,
+		arg.Host,
+		arg.Port,
+		arg.Username,
+		arg.Password,
+		arg.FromAddress,
+		arg.FromName,
+		arg.UseTls,
+	)
+	return err
+}