feat(config): DB-backed system_config infrastructure + SMTP group

Add a generic admin-editable config layer (epic 4a): system_config KV table
(migration 0021), a sysconfig registry that is the single source of truth for
DB-overridable keys (type/group/default/bounds/secret) + a DB-override-or-env
resolver, and admin endpoints (GET/PATCH/DELETE /api/admin/config + a test-email
probe). Secrets are Fernet-encrypted at rest (TOKEN_ENCRYPTION_KEY); without it
they stay env-only. First group wired end-to-end: Email/SMTP — email.py now
reads host/port/user/from/password via the resolver (own session, since email
is sent from background tasks).

backend/app/models.py

@@ -358,6 +358,24 @@ class SchedulerSetting(Base):
     interval_minutes: Mapped[int] = mapped_column(Integer)
 
 
+class SystemConfig(Base):
+    """Admin-set overrides for operational config that otherwise comes from env/config
+    defaults. Generic key/value store (one row per key); absent = use the env/config
+    default. DB-backed so it's editable from the admin Configuration page at runtime without
+    a redeploy. Secret values (e.g. SMTP password) are stored Fernet-encrypted (`encrypted`
+    flag) using TOKEN_ENCRYPTION_KEY; non-secrets are plaintext. The set of known keys + their
+    types/groups/defaults lives in app.sysconfig (the single source of truth)."""
+
+    __tablename__ = "system_config"
+
+    key: Mapped[str] = mapped_column(String(64), primary_key=True)
+    value: Mapped[str | None] = mapped_column(Text)
+    encrypted: Mapped[bool] = mapped_column(Boolean, default=False, server_default="false")
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), default=func.now(), onupdate=func.now()
+    )
+
+
 class Playlist(Base):
     """A per-user named, ordered collection of videos from the shared catalog.