Add setup console and settings APIs

[Dadud]

Summary

This PR adds the first browser-based setup/settings console slice:

• adds SQLite-backed app settings, setup state, encrypted write-only secrets, and settings audit tables
• adds setup status, setup checks, admin setup, settings, secret, provider-test, and setup-completion APIs
• adds read-only processing job diagnostics APIs for summary and recent jobs
• makes the webserver setup-mode friendly by warning instead of exiting on missing production config
• adds a static /setup wizard and /settings console using the existing no-build frontend approach
• links the map Settings menu to the new Settings Console
• expands syntax checks to include the new browser scripts
• adds unit coverage for settings precedence, secret redaction/encryption, setup status, setup checks, job diagnostics, and migrations

Verification

• npm test
• npm run check:syntax
• npm run check:config

Notes

The webserver app was not smoke-run locally because this workspace does not currently have
ode_modules installed. Existing env-based geocoding key behavior is preserved for the map UI; SQLite-stored setup/settings secrets are write-only and never returned by the settings APIs.

This is stacked on top of PR #12.