Add Authentik SSO, budget visibility, Resend email, 12h item default

Opens Veola up to more users (Parodia's Authentik) and makes Apify spend
visible to everyone.

- Auth: Traefik forward-auth (trust X-Authentik-* headers only from
  trusted_proxies CIDRs, keyed by email, role synced from admin_group),
  keeping local password login as break-glass. New [auth] config,
  CaptureDirectIP + ForwardAuth middleware, deploy/authentik-forward-auth.md.
- Budget: count every Apify run (apify_api_usage table) and show
  calls + estimated cost to all users on the dashboard, with an optional
  monthly-budget bar. New [budget] config + settings.
- Email: Resend client for opt-in deal alerts and a weekly digest
  (Mon 09:00). Per-user email + toggles on Settings. New [resend] config.
- Defaults: new items default to a 12-hour poll interval to cut spend.

users table gains email/auth_source/email-pref columns (migrated in place).
go build/vet/test green; boots and migrates cleanly.

internal/db/db.go

@@ -53,6 +53,27 @@ func Open(path string) (*sql.DB, error) {
 		conn.Close()
 		return nil, err
 	}
+	// Multi-user / email columns (Authentik forward-auth + Resend mail).
+	for _, c := range []struct{ col, typ string }{
+		{"email", "TEXT"},
+		{"auth_source", "TEXT NOT NULL DEFAULT 'local'"},
+		{"email_deal_alerts", "INTEGER NOT NULL DEFAULT 0"},
+		{"email_weekly_digest", "INTEGER NOT NULL DEFAULT 0"},
+	} {
+		if err := addColumnIfMissing(conn, "users", c.col, c.typ); err != nil {
+			conn.Close()
+			return nil, err
+		}
+	}
+	// Email is the identity key for forward-auth (Authentik) and the Resend
+	// destination. Partial unique index: many local users may have no email
+	// (NULL/'') while any populated address stays unique. Created here, after
+	// the email column exists, so it works on both fresh and migrated DBs.
+	if _, err := conn.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_users_email
+		ON users(email) WHERE email IS NOT NULL AND email != ''`); err != nil {
+		conn.Close()
+		return nil, fmt.Errorf("create users email index: %w", err)
+	}
 	return conn, nil
 }