Add Authentik SSO, budget visibility, Resend email, 12h item default

Opens Veola up to more users (Parodia's Authentik) and makes Apify spend
visible to everyone.

- Auth: Traefik forward-auth (trust X-Authentik-* headers only from
  trusted_proxies CIDRs, keyed by email, role synced from admin_group),
  keeping local password login as break-glass. New [auth] config,
  CaptureDirectIP + ForwardAuth middleware, deploy/authentik-forward-auth.md.
- Budget: count every Apify run (apify_api_usage table) and show
  calls + estimated cost to all users on the dashboard, with an optional
  monthly-budget bar. New [budget] config + settings.
- Email: Resend client for opt-in deal alerts and a weekly digest
  (Mon 09:00). Per-user email + toggles on Settings. New [resend] config.
- Defaults: new items default to a 12-hour poll interval to cut spend.

users table gains email/auth_source/email-pref columns (migrated in place).
go build/vet/test green; boots and migrates cleanly.

internal/models/models.go

@@ -17,7 +17,15 @@ type User struct {
 	Username     string
 	PasswordHash string
 	Role         Role
-	CreatedAt    time.Time
+	// Email is the address Resend mail is sent to and the identity key used
+	// to match a forward-auth (Authentik) identity to a local row. Optional
+	// for password-login users.
+	Email string
+	// AuthSource is "local" (password) or "forward" (Traefik forward-auth).
+	AuthSource        string
+	EmailDealAlerts   bool
+	EmailWeeklyDigest bool
+	CreatedAt         time.Time
 }
 
 type Item struct {