Add Authentik SSO, budget visibility, Resend email, 12h item default

Opens Veola up to more users (Parodia's Authentik) and makes Apify spend
visible to everyone.

- Auth: Traefik forward-auth (trust X-Authentik-* headers only from
  trusted_proxies CIDRs, keyed by email, role synced from admin_group),
  keeping local password login as break-glass. New [auth] config,
  CaptureDirectIP + ForwardAuth middleware, deploy/authentik-forward-auth.md.
- Budget: count every Apify run (apify_api_usage table) and show
  calls + estimated cost to all users on the dashboard, with an optional
  monthly-budget bar. New [budget] config + settings.
- Email: Resend client for opt-in deal alerts and a weekly digest
  (Mon 09:00). Per-user email + toggles on Settings. New [resend] config.
- Defaults: new items default to a 12-hour poll interval to cut spend.

users table gains email/auth_source/email-pref columns (migrated in place).
go build/vet/test green; boots and migrates cleanly.

main.go

@@ -68,6 +68,18 @@ func run(configPath string) error {
 	if err != nil {
 		return fmt.Errorf("auth manager: %w", err)
 	}
+	if cfg.Auth.ForwardAuthEnabled() {
+		fa, err := auth.NewForwardAuthConfig(
+			cfg.Auth.ForwardHeaderUser, cfg.Auth.ForwardHeaderEmail,
+			cfg.Auth.ForwardHeaderName, cfg.Auth.ForwardHeaderGroups,
+			cfg.Auth.AdminGroup, cfg.Auth.TrustedProxies,
+		)
+		if err != nil {
+			return fmt.Errorf("forward-auth config: %w", err)
+		}
+		authMgr.SetForwardAuth(fa)
+		slog.Info("forward-auth enabled", "trusted_proxies", cfg.Auth.TrustedProxies, "admin_group", cfg.Auth.AdminGroup)
+	}
 
 	apifyClient := apify.New(cfg.Apify.APIKey)
 	ntfyClient := ntfy.New(cfg.Ntfy.BaseURL)