feat: add app settings table, encryption utility, and generic email service

- app_settings table with encrypted field support (AES-256-GCM, key from ENCRYPTION_KEY env)
- SettingsService for transparent encrypt/decrypt on get/set
- EmailService factory with Resend and SendGrid providers (SMTP stub) — provider config lives in app_settings
- Seeds initial admin user and email settings from env vars on first startup if not already present
- Migration 0039_app_settings.sql

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/backend/src/db/migrations/0039_app_settings.sql

@@ -0,0 +1,8 @@
+CREATE TABLE IF NOT EXISTS "app_settings" (
+  "key" varchar(100) PRIMARY KEY,
+  "value" text,
+  "is_encrypted" boolean NOT NULL DEFAULT false,
+  "iv" text,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);