Add Authentik SSO, budget visibility, Resend email, 12h item default

Opens Veola up to more users (Parodia's Authentik) and makes Apify spend
visible to everyone.

- Auth: Traefik forward-auth (trust X-Authentik-* headers only from
  trusted_proxies CIDRs, keyed by email, role synced from admin_group),
  keeping local password login as break-glass. New [auth] config,
  CaptureDirectIP + ForwardAuth middleware, deploy/authentik-forward-auth.md.
- Budget: count every Apify run (apify_api_usage table) and show
  calls + estimated cost to all users on the dashboard, with an optional
  monthly-budget bar. New [budget] config + settings.
- Email: Resend client for opt-in deal alerts and a weekly digest
  (Mon 09:00). Per-user email + toggles on Settings. New [resend] config.
- Defaults: new items default to a 12-hour poll interval to cut spend.

users table gains email/auth_source/email-pref columns (migrated in place).
go build/vet/test green; boots and migrates cleanly.

internal/db/schema.sql

@@ -6,8 +6,18 @@ CREATE TABLE IF NOT EXISTS users (
     username      TEXT NOT NULL UNIQUE,
     password_hash TEXT NOT NULL,
     role          TEXT NOT NULL DEFAULT 'user',
+    email         TEXT,
+    -- auth_source records how the row was provisioned: 'local' (password
+    -- login / setup) or 'forward' (Traefik forward-auth from Authentik). For
+    -- forward rows the role is re-synced from the IdP group on every request.
+    auth_source         TEXT NOT NULL DEFAULT 'local',
+    email_deal_alerts   INTEGER NOT NULL DEFAULT 0,
+    email_weekly_digest INTEGER NOT NULL DEFAULT 0,
     created_at    DATETIME DEFAULT CURRENT_TIMESTAMP
 );
+-- The email column and its unique index are created in db.go AFTER the
+-- addColumnIfMissing migrations, so existing databases (whose users table
+-- predates the email column) gain the column before the index references it.
 
 CREATE TABLE IF NOT EXISTS items (
     id                    INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -92,7 +102,20 @@ INSERT OR IGNORE INTO settings (key, value) VALUES
     ('ntfy_base_url', ''),
     ('ntfy_default_topic', 'veola'),
     ('global_poll_interval_minutes', '60'),
-    ('match_confidence_threshold', '0.6');
+    ('match_confidence_threshold', '0.6'),
+    ('apify_cost_per_call', '0.00'),
+    ('monthly_budget_usd', '0.00'),
+    ('resend_api_key', ''),
+    ('resend_from', '');
+
+-- apify_api_usage tracks Apify actor runs per UTC day so the operator (and
+-- every signed-in user) can see consumption and an estimated spend. Apify
+-- bills per actor run / per result, which Veola cannot read back exactly, so
+-- this is a call counter multiplied by a configurable per-call cost estimate.
+CREATE TABLE IF NOT EXISTS apify_api_usage (
+    usage_date TEXT PRIMARY KEY,
+    call_count INTEGER NOT NULL DEFAULT 0
+);
 
 -- ebay_api_usage tracks Browse API calls per day so Veola can surface
 -- consumption and halt polling before the developer keyset's daily call