feat: DB-backed module settings with admin UI

[antosubash]

Summary

Migrates the framework from SM_<MODULE>_* env vars to a DB-backed settings system with a live admin UI. Each module's BaseSettings class is hydrated from a single settings_override table at lifespan start, overrides are edited at /settings/modules, and changes hot-swap into app.state via a SettingsReloaded event without a restart (except where fields are explicitly requires_restart).

What changed

Framework plumbing

• ModuleSettingsRegistry on SettingsServices — packages register their BaseSettings class via register_module_settings(app, cls).
• SettingsStore — module-namespaced overrides; CRUD + typed get_overrides().
• hydrate_settings(cls, store, package) — merges DB overrides onto defaults with typed coercion.
• apply_changes_and_reload — validates via pydantic, persists the diff, hot-swaps app.state.<pkg>.settings, publishes SettingsReloaded.
• Hydration runs at the start of the host lifespan before any on_startup hook.

Hosting split

• BootstrapSettings (env-only, needed before DB opens) vs HostSettings (hydrated). Legacy Settings remains as a back-compat shim that inherits both.
• Host registers itself as package="host" so the admin UI can edit host-level knobs.

Per-module migration

• users, background_tasks, file_storage, datasets, settings — all now register their settings class. users.allow_signup gates at request time via a dependency so the toggle takes effect without a restart. Celery-owned fields are marked requires_restart.

REST API (modules/settings/settings/endpoints/module_api.py)

• GET /api/settings/modules — list all registered modules + fields.
• GET /api/settings/modules/{package} — single module.
• PUT /api/settings/modules/{package} — apply changes (pydantic validation → 422 with per-field errors).
• DELETE /api/settings/modules/{package}/{field} — reset one field to default.

Admin UI (/settings/modules)

• ModulesEdit.tsx — sidebar + main panel with search filter.
• ModuleForm.tsx — grouped fields, dirty tracking, per-field reset, 422 error display, "requires restart" badge when a restart-gated field is dirty.
• FieldInput.tsx — type-driven rendering (bool→checkbox, int/float→number, json→textarea, string→text). Secret fields render masked with a "Set new value" reveal.

CLI

• sm-settings import-from-env — one-shot migration: reads SM_<MODULE>_* env vars and writes them into settings_override.

Docs

• Release note at docs/release-notes/2026-04-21-db-backed-settings.md.
• .env.example trimmed to bootstrap-only (DB_URL, environment, secret, vite).
• README config section rewritten.

Test plan

• make test-py (853 passed)
• make test-js (8 passed)
• make lint (ruff, ty, biome, tsc, file-size all clean)
• E2E toggle test (tests/e2e/test_settings_ui.py) verifies an admin can flip a setting and read it back through the REST API
• Reviewer: spot-check /settings/modules in a running dev env — edit a non-restart field on users, confirm it takes effect on the next request without a restart
• Reviewer: run sm-settings import-from-env against a populated .env and confirm the overrides land in settings_override

Notes for reviewers

• Framework→plugin coupling rule (SM009) is preserved: _hydrate_step.py uses importlib.import_module("settings.hydrate") at call time rather than a top-level import.
• docker-compose.yml deliberately keeps SM_BG_TASKS_* — those are deployment-plumbing for the Celery worker container, not runtime config.
• The simplify pass (last commit) consolidated env-prefix resolution into settings.env_vars, removed dead code, added a no-op short-circuit to apply_changes_and_reload, and tightened the React form's dirty-tracking to avoid per-keystroke JSON.stringify bloat.