feat(config): DB-backed system_config infrastructure + SMTP group

Add a generic admin-editable config layer (epic 4a): system_config KV table
(migration 0021), a sysconfig registry that is the single source of truth for
DB-overridable keys (type/group/default/bounds/secret) + a DB-override-or-env
resolver, and admin endpoints (GET/PATCH/DELETE /api/admin/config + a test-email
probe). Secrets are Fernet-encrypted at rest (TOKEN_ENCRYPTION_KEY); without it
they stay env-only. First group wired end-to-end: Email/SMTP — email.py now
reads host/port/user/from/password via the resolver (own session, since email
is sent from background tasks).

backend/app/main.py

@@ -29,6 +29,7 @@ from app.config import settings
 from app.routes import (
     admin,
     channels,
+    config as config_routes,
     feed,
     health,
     me,
@@ -82,6 +83,7 @@ app.include_router(notifications.router)
 app.include_router(channels.router)
 app.include_router(playlists.router)
 app.include_router(admin.router)
+app.include_router(config_routes.router)
 app.include_router(scheduler_routes.router)
 app.include_router(quota.router)
 app.include_router(version.router)