feat: add app settings table, encryption utility, and generic email service

- app_settings table with encrypted field support (AES-256-GCM, key from ENCRYPTION_KEY env)
- SettingsService for transparent encrypt/decrypt on get/set
- EmailService factory with Resend and SendGrid providers (SMTP stub) — provider config lives in app_settings
- Seeds initial admin user and email settings from env vars on first startup if not already present
- Migration 0039_app_settings.sql

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/backend/src/db/index.ts

@@ -3,3 +3,4 @@ export * from './schema/users.js'
 export * from './schema/accounts.js'
 export * from './schema/inventory.js'
 export * from './schema/pos.js'
+export * from './schema/settings.js'

packages/backend/src/db/migrations/0039_app_settings.sql

@@ -0,0 +1,8 @@
+CREATE TABLE IF NOT EXISTS "app_settings" (
+  "key" varchar(100) PRIMARY KEY,
+  "value" text,
+  "is_encrypted" boolean NOT NULL DEFAULT false,
+  "iv" text,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);

packages/backend/src/db/schema/settings.ts

@@ -0,0 +1,13 @@
+import { pgTable, varchar, text, boolean, timestamp } from 'drizzle-orm/pg-core'
+
+export const appSettings = pgTable('app_settings', {
+  key: varchar('key', { length: 100 }).primaryKey(),
+  value: text('value'),
+  isEncrypted: boolean('is_encrypted').notNull().default(false),
+  iv: text('iv'),
+  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
+})
+
+export type AppSetting = typeof appSettings.$inferSelect
+export type AppSettingInsert = typeof appSettings.$inferInsert