feat(app): wire settings registry into startup and admin routes

Construct the SettingsRegistry at boot, load it, and thread it through
every consumer so the configurable values take effect and stay cached.

cmd/server/main.go:
- Build the registry from the Queries handle and Load() it right after
  schema init; a load failure logs and continues (getters fall back to
  compiled defaults, so startup is never blocked).
- Wire the registry into the package-level password validator
  (SetDefaultPasswordSettings) and call SetSettings on every handler/
  service that reads tunables: AuthHandler, DeviceAuthMiddleware,
  OPDSHandler, SidecarHandler, SystemSettingsHandler,
  AnnotationService, ConversionService.
- Source the restart-time values from the registry: login lockout
  (max attempts + duration) feeds NewLoginAttemptTracker, and the new
  NewSyncQueueProcessorWithConfig / NewWorkerWithConfig take the sync
  queue and worker pool configs.

router.go:
- Config gains a Settings *database.SettingsRegistry field.
- The global auth rate limiter now reads RequestsPerMinute from
  registry.AuthRateLimit() (env stays as the enabled/disabled switch
  and as the fallback if the registry is unset).

admin_library.go:
- The HTMX scan-settings save endpoint reloads the registry after
  writing so the change is visible without a page reload.
- Add PUT /admin/settings/tunable: a small HTMX endpoint that calls
  SystemSettingsHandler.ApplySetting and returns a colored status
  snippet ("Saved" or "Saved — restart required") for the admin UI's
  per-row forms.

internal/router/router.go

@@ -39,6 +39,7 @@ type Config struct {
 	Echo                    *echo.Echo
 	Queries                 *database.Queries
 	Cfg                     *config.Config
+	Settings                *database.SettingsRegistry
 	DBPool                  interface{} // pgxpool.Pool interface
 	AuthHandler             *handlers.AuthHandler
 	LibraryHandler          *handlers.LibraryHandler
@@ -211,10 +212,12 @@ func RegisterRoutes(cfg *Config) *handlers.Handler {
 	// Setup redirect middleware - must run before all routes
 	e.Pre(setupRedirectMiddleware(cfg))
 
-	// Rate limiter
+	// Rate limiter. The per-minute value comes from the settings registry (DB);
+	// the enabled flag stays env-driven since disabling rate limiting is a
+	// deployment-time decision, not a runtime tunable.
 	rateLimiterConfig := ratelimit.RateLimiterConfig{
 		Enabled:           cfg.Cfg.RateLimitEnabled,
-		RequestsPerMinute: cfg.Cfg.RequestsPerMinute,
+		RequestsPerMinute: cfg.Settings.AuthRateLimit(),
 		CleanupInterval:   5 * time.Minute,
 	}
 	rateLimiter := ratelimit.NewRateLimiter(rateLimiterConfig)