feat(db/m7-user-mgmt): migration 0024 + self-service + SMTP queries (U3)

Adds users.email (optional, lowercase-unique via partial index),
smtp_config singleton, and password_resets tokens. Plus the
queries U3-T2 / T3 / T4 use:

- ChangeUserPassword: self-service password change. HTTP layer
  verifies the current password before this fires.
- UpdateUserProfile: set display_name + email together.
- RegenerateApiToken: invalidate old API token.
- GetUserByEmail: case-insensitive lookup for forgot-password.
- GetSMTPConfig + UpdateSMTPConfig: admin SMTP settings CRUD.
- CreatePasswordReset / GetPasswordReset / UsePasswordReset
  (:execrows for atomic claim) / DeleteExpiredPasswordResets
  (cron-style cleanup, not yet wired).

Email column is nullable; users without email have admin-reset
as their only password-recovery path. The lower() unique index
allows many NULLs and prevents case-insensitive duplicates.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/db/queries/smtp_config.sql

@@ -0,0 +1,15 @@
+-- name: GetSMTPConfig :one
+SELECT * FROM smtp_config WHERE id = true;
+
+-- name: UpdateSMTPConfig :exec
+UPDATE smtp_config
+   SET enabled      = $1,
+       host         = $2,
+       port         = $3,
+       username     = $4,
+       password     = $5,
+       from_address = $6,
+       from_name    = $7,
+       use_tls      = $8,
+       updated_at   = now()
+ WHERE id = true;