Add Authentik SSO, budget visibility, Resend email, 12h item default

Opens Veola up to more users (Parodia's Authentik) and makes Apify spend
visible to everyone.

- Auth: Traefik forward-auth (trust X-Authentik-* headers only from
  trusted_proxies CIDRs, keyed by email, role synced from admin_group),
  keeping local password login as break-glass. New [auth] config,
  CaptureDirectIP + ForwardAuth middleware, deploy/authentik-forward-auth.md.
- Budget: count every Apify run (apify_api_usage table) and show
  calls + estimated cost to all users on the dashboard, with an optional
  monthly-budget bar. New [budget] config + settings.
- Email: Resend client for opt-in deal alerts and a weekly digest
  (Mon 09:00). Per-user email + toggles on Settings. New [resend] config.
- Defaults: new items default to a 12-hour poll interval to cut spend.

users table gains email/auth_source/email-pref columns (migrated in place).
go build/vet/test green; boots and migrates cleanly.

internal/handlers/items.go

@@ -16,6 +16,10 @@ import (
 	"veola/templates"
 )
 
+// defaultPollIntervalMinutes is the poll cadence pre-selected on the add-item
+// form: 12 hours, chosen to keep Apify spend low by default.
+const defaultPollIntervalMinutes = 720
+
 func (a *App) GetItems(w http.ResponseWriter, r *http.Request) {
 	cat := r.URL.Query().Get("category")
 	all, err := a.Store.ListItems(r.Context())
@@ -56,8 +60,11 @@ func (a *App) GetNewItem(w http.ResponseWriter, r *http.Request) {
 		IsEdit:     false,
 		Categories: cats,
 		Item: models.Item{
-			NtfyPriority:        "default",
-			PollIntervalMinutes: a.Cfg.Scheduler.GlobalPollIntervalMinutes,
+			NtfyPriority: "default",
+			// Default new items to a 12-hour refresh. Apify runs cost credits
+			// and most watched items do not move hour-to-hour, so a slow
+			// default keeps spend down; the operator can dial it tighter.
+			PollIntervalMinutes: defaultPollIntervalMinutes,
 			Marketplaces:        []string{"ebay.com"},
 			ListingType:         "all",
 		},