feat(config): DB-backed system_config infrastructure + SMTP group

Add a generic admin-editable config layer (epic 4a): system_config KV table
(migration 0021), a sysconfig registry that is the single source of truth for
DB-overridable keys (type/group/default/bounds/secret) + a DB-override-or-env
resolver, and admin endpoints (GET/PATCH/DELETE /api/admin/config + a test-email
probe). Secrets are Fernet-encrypted at rest (TOKEN_ENCRYPTION_KEY); without it
they stay env-only. First group wired end-to-end: Email/SMTP — email.py now
reads host/port/user/from/password via the resolver (own session, since email
is sent from background tasks).

backend/alembic/versions/0021_system_config.py

@@ -0,0 +1,38 @@
+"""generic admin-editable system_config key/value store
+
+Revision ID: 0021_system_config
+Revises: 0020_rename_quota_actions
+Create Date: 2026-06-19
+
+Adds the system_config table: admin overrides for operational config that otherwise comes
+from env/config defaults (see app.sysconfig for the registry of known keys). Secret values
+are stored Fernet-encrypted (encrypted flag). Purely additive; absent rows = use defaults.
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0021_system_config"
+down_revision: Union[str, None] = "0020_rename_quota_actions"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "system_config",
+        sa.Column("key", sa.String(length=64), primary_key=True),
+        sa.Column("value", sa.Text(), nullable=True),
+        sa.Column("encrypted", sa.Boolean(), nullable=False, server_default="false"),
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            nullable=False,
+            server_default=sa.func.now(),
+        ),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("system_config")